4 ms·
Who's still using 3DES? That should already be a shooting offense anywhere where security matters.
by qwertyuiop924 10y ago
Who's still using 3DES? That should already be a shooting offense anywhere where security matters.
- forbiddenlake 10y agoThe OpenVPN Hardening wiki says 3DES-EDE is still fine https://community.openvpn.net/openvpn/wiki/Hardening https://community.openvpn.net/openvpn/wiki/Hardening
- tedunangst 10y agoHas the OpenVPN wiki been reviewed and updated to reflect SWEET32?
- subliminalpanda 10y agoTheir latest release now actively discourages 64 bit block ciphers: Steffan Karger (4): Fix polarssl / mbedtls builds Don't limit max incoming message size based on c2->frame Fix '--cipher none --cipher' crash Discourage using 64-bit block ciphers https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.12 https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn2...
- mhurron 10y ago> The OpenVPN Hardening wiki says 3DES-EDE is still fine Last modified 2 years ago
- hsivonen 10y agoSites that want to support IE8 on XP while disabling RC4. https://www.ssllabs.com/ssltest/viewClient.html?name=IE&version=8&platform=XP&key=101 https://www.ssllabs.com/ssltest/viewClient.html?name=IE&vers...
- qwertyuiop924 10y agosigh Thank you, IE, for once again royally screwing all of us over.
- serge2k 10y agoThen drop support.
- qwertyuiop924 10y agoI'm not the one writing for it, and I'm not the one who's forced to support it by their employers.
- tedunangst 10y agoWell then it seems a little exaggerated to say "all of us", no?
- stcredzero 10y agoIf you lump this in with all of the other effects IE has had on internet standards over the years, then it is accurate enough.
- qwertyuiop924 10y agoIt's holding back positive progress in a number of fields.
- yuhong 10y agoMore precisely, XP SChannel.
- tptacek 10y agoCareful. "Everyone" knows not to use DES, but lots of people still think Blowfish is OK. The problem is 64-bit blocks, not DES in particular. There are related problems in CTR constructions, including modern stuff like AES-GCM (the number of bytes you need to encrypt is far bigger, but the security consequences are worse).
- qwertyuiop924 10y agoWell, yes. That's why the official recommendation from Schneier has been at least Threefish forever.
- alcari 10y agoPCI-DSS says 112 bits of security is "strong cryptography", just so people can continue using 3DES.
- CiPHPerCoder 10y agoStrictly speaking, 112 bits of "security" is "strong" enough. The problem is this is usually measured as the log (base 2) of the number of possible secret keys. It ignores: - Block size <- YOU ARE HERE - Cipher mode - Cipher construction and integrity checks (for non-AEAD modes) - Key exchange You can break 256 bit AES if you're using 256-bit classical Diffie Hellman, for example. "But AES has 256 bits of security!" is somewhat silly to argue in such a hypothetical protocol. This is one reason why you're better off ignoring PCI-DSS when it comes to cryptography guidelines (aside from maintaining compliance where you have obligations to remain compliant, of course).
- jgalt212 10y agoPer the wiki: The electronic payment industry uses Triple DES and continues to develop and promulgate standards based upon it (e.g. EMV). https://en.wikipedia.org/wiki/Triple_DES https://en.wikipedia.org/wiki/Triple_DES
- qwertyuiop924 10y ago...that's terrifying.
- jgalt212 10y agomaybe not, because if triple DES were so unsafe wouldn't there be a lot more theft?