3 ms·
Lessons from the Juniper Dual EC Incident (2018)
- theamk 6y agoI am surprised people cared about Dual EC in 2014 -- it was considered dangerous back in 2007[0], and in 2013, NIST recommended against using it ([1], pdf) Btw, for those who have not seen it, there is a nice story about OpenSSL devs who both had to implemented DualEC for certification, and knew the algorithm was bad and should not have been used. As a result, the implementation was produced, but had a fatal bug which prevented it from being used outside of testing [2]. [0] https://www.wired.com/2007/11/securitymatters-1115/ https://www.wired.com/2007/11/securitymatters-1115/ [1] http://csrc.nist.gov/publications/nistbul/itlbul2013_09_supplemental.pdf http://csrc.nist.gov/publications/nistbul/itlbul2013_09_supp... [2] https://lwn.net/Articles/578375/ https://lwn.net/Articles/578375/
- burnte 6y ago"In December 2015, Juniper Networks announced multiple security vulnerabilities stemming from unauthorized code in ScreenOS" Wow, I never heard anything about this. This seems huge.