3 ms·
Are we sure of that? It was also thought that nobody would have enabled Dual EC by default, and however somebody did. Even without an allocated extension number
by cesarb 11y ago
Are we sure of that? It was also thought that nobody would have enabled Dual EC by default, and however somebody did. Even without an allocated extension number, somebody could have used an unassigned one for "testing".
- tptacek 11y agoDual_EC was actively recommended, on the auspices that deployed cryptosystems already depended on number theoretic security guarantees, and that it made sense to minimize the number of things one's cryptosystem depends on. Extended-random was proposed as a way to allow DoD to deploy TLS on its networks, rather than using custom crypto protocols. OpaquePRF in particular was explicitly about getting TLS to play well with the Suite B policies. It was never recommended as a deployment default. You have probably never used a crypto tool that used either Dual_EC or extended-random, for what it's worth.
- MiWDesktopHack 11y ago> You have probably never used a crypto tool that used either Dual_EC or extended-random, for what it's worth. Dual_EC was default PRNG in BSAFE-SSL-C for almost a decade. Shodan matched 1700 banners from this time, online now. The chance that a person interacted with a https service in that time is quite high I would think.
- tptacek 11y agoAll of these banners are from the "Red Hat Secure Web Server". I don't know what that is, but someone else here might. I'd be interested in finding out more about Red Hat Secure Server: * It switched from OpenSSL to BSAFE-C in/around 2000 * RSA defaulted BSAFE to Dual_EC in 2004 * The last release I can see for Red Hat Secure Web Server is in 2003 * Red Hat Secure Web Server is EOL'd now. A helpful Twitter points out this mailing list post from 2003: http://blog.gmane.org/gmane.linux.redhat.security.server http://blog.gmane.org/gmane.linux.redhat.security.server ... in which it's stated that Red Hat Secure Web Server had been EOL for some time. It's looking more likely that those Shodan banners are not TLS implementations with Dual_EC defaults.
- MiWDesktopHack 11y agoHi Thomas, Thank for following this up. I think you are right. RH SWS was EOL before the Dual_EC default switch was made. If the only public banners for this product are from before this time, I will conceed that DUAL_EC likely never saw use on the Public Internet. Pls unblock me on twitter ;-)
- tptacek 11y agoI don't think I block you on Twitter.
- MiWDesktopHack 11y agotwitter: _MiW i said something silly and you blocked me. lets move on and continue an intellectual dialog
- throwaway2048 11y agowhat about RSA making DUAL_EC_DRBG the default in their BSAFE crypto library?
- tptacek 11y agoI think Dual_EC is a backdoor just like everyone else. It's extended-random I have questions about.