[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20131113160910.GI7623@localhost.localdomain>
Date: Wed, 13 Nov 2013 11:09:10 -0500
From: "Eric H. Christensen" <echriste@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Microsoft Warns Customers Away From RC4 and SHA-1
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On Wed, Nov 13, 2013 at 07:57:51AM -0800, Tim wrote:
> > I'm inclined to agree. The question I suppose is, like DES (and
> > 3DES/MD5) at what point do we start assigning CVE's for some of this?
> > thoughts and comments welcome.
>
> Using a weak encyption algorithm alone isn't a sufficient condition to
> issue a CVE against software, since often the context of the usage
> matters a lot. If you use MD5 or SHA-1 for password hashing (with
> lots of salt and rounds), then there's no vulnerability. If you use
> them for HMACs, then there's also likely no problem. But if you use
> them for a signature with a public key, there is.
It's answers like this that make it difficult for non-security-literate system administrators to make good decisions. I completely understand and agree with what you wrote but I wonder if we're making it harder for people to understand how to protect themselves.
After having many similar conversations with people that manage systems I find that it's usually easier to say "MD5 bad, SHA-256 good" and then just walk away. Perhaps some sort of chart should be published that allows people to make better decisions?
- -- Eric
- --------------------------------------------------
Eric "Sparks" Christensen
Red Hat, Inc - Product Security Team
sparks@...hat.com - sparks@...oraproject.org
097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1
- --------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
iQGcBAEBCgAGBQJSg6QjAAoJEB/kgVGp2CYvHCoL/0lcSKwfskG9b8ltQoWFfBUF
WEVB8JJOa+tfLG66tFFtIJtqBgR4cXK6fVaFu4N5n7J/xJ5ULPdE6OX72njSEH28
4WHi0I8N0otvUe0RPETTKgm5UW4cIFbamc3RGtwYtmA6N0Y2w6Xpzvnu7TAQ2lr7
6tz1gMy1GUKbwDxeyRgVqqAZk5uQp90L4mqPadMXTtqfUtbDX6JOU1lSN6rFd88S
IGXMNICDJx3i6ErwJfxyfhLU/GcnLx4g7evTcet/LVR/An6V7FrCMf9PW19Lx5xv
CIbHZGxhJDzA1pJ1/h+Oh2X4qGvmV5w5NUMIhdyVH2Mf/4DscxWZS6FpvaBKb0ax
WZLWtoC2K9LEyiJq+VYMVMXhLwUy6oTMnenS/yGfdxBHLdI3uP9Sva7E0otdReLo
6qrQVNW0KStL8D8MJ832tJ5jYx01SBQA5l1cUMwHrmGzC+VxE6cDAQ9FUc1v9+8p
M/YbSc35J0paRZCpcL9tzQV38fZb/hvO8zbvKJ4zDQ==
=MiSz
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
