full-disclosure - Debian OpenSSL vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20080515.6d97b2db2d3bb298da26dcfb106e6fa1@cynops.de>
Date: Thu, 15 May 2008 14:10:52 +0200
From: Alexander Klink <a.klink@...ops.de>
To: full-disclosure@...ts.grok.org.uk
Subject: Debian OpenSSL vulnerability - major CAs
	unaffected

Hi,

some good news in the whole Debian OpenSSL vulnerability mess:
We have tested all the CAs with 1024 and 2048 bit keys with a
public exponent of 653537 which are included in the
Windows or Mozilla CA store against our list of known weak keys,
but none of them were affected.
Not that we expected that they were, but we thought it might be better
to check ;-)
A minor 13% has not been tested because they were using different
key lengths or public exponents ...

Cheers,
  Alex
-- 
Dipl.-Math. Alexander Klink | IT-Security Engineer |    a.klink@...ops.de
 mobile: +49 (0)178 2121703 |          Cynops GmbH | http://www.cynops.de
----------------------------+----------------------+---------------------
      HRB 7833, Amtsgericht | USt-Id: DE 213094986 |     Geschäftsführer:
     Bad Homburg v. d. Höhe |                      |      Martin Bartosch

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/