Date: Tue, 8 Apr 2014 12:25:12 +0300 From: Georgi Guninski <guninski@...inski.com> To: oss-security@...ts.openwall.com Subject: Should openssl accept weak DSA/DH keys with g = +/- 1 ? Not on list. I am a noob at crypto. IIRC similar attack was used against Tor several years ago. In DSA it is possible to force g=1 or g \equiv -1 \mod p. The first is unit and the second is of multiplicative order 2. This are clearly weak and insane choices, but this might have implications to MITM (might be wrong on this). For DH could generate key with g=1, though couldn't test it. Tested both 1 and -1 cases in DSA, the probability of successful connection was about 1/4 (or maybe 1/2), errors in the other cases. (for $1$ I would expect probability $1$). Attached are cacert.pem and cacert2.pem, the magic word is 1234. To test: $ openssl s_server -accept 8888 -www -cert cacert.pem $ openssl s_client -connect localhost:8888 -showcerts To examine $openssl x509 -text -in cacert2.pem $openssl dhparam -text -in dHParam.pem (not sure if dHParam.pem this is usable, forged generation). Firefox refuses connections, Konqueror works with same probability. Suspect this might be related to EC refusing the point at infinity. Might have MITM implications, don't have working exploit (If a MITM can forge $g=1$ in DH, the private keys are useless). View attachment "cacert.pem" of type "text/plain" (1968 bytes) View attachment "cacert2.pem" of type "text/plain" (1563 bytes) View attachment "dHParam.pem" of type "text/plain" (246 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.