OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
intothesymmetry.blogspot.com
OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
1–10 of 22 posts
Re: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
#2hi the author of the vuln here. this is my write up http://intothesymmetry.blogspot.ch/2016/01/openssl-key-recov...
Re: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
#3hi the author of the vuln here. this is my write up http://intothesymmetry.blogspot.ch/2016/01/openssl-key-recov...
Re: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
#4hi the author of the vuln here. this is my write up http://intothesymmetry.blogspot.ch/2016/01/openssl-key-recov...
Thanks for the excellent description of the vuln!
You mention Apache not being vulnerbale. I just looked through the Nginx code, and it doesn't seem to be vulnerable either because Igor Sysoev enabled SSL_OP_SINGLE_DH_USE back in 2008.
https://github.com/nginx/nginx/blob/master/src/event/ngx_eve...
Re: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
#5hi the author of the vuln here. this is my write up http://intothesymmetry.blogspot.ch/2016/01/openssl-key-recov...
Thanks for the excellent description of the vuln! You mention Apache not being vulnerbale. I just looked through the Nginx code, and it doesn't seem to be vulnerable either because Igor Sysoev enabled SSL_OP_SINGLE_DH_USE back in 2008. https://github.com/nginx/nginx/blob/master/src/event/ngx_eve...
indeed. but there is always Static DH :) even if not so popular...
Re: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
#6Super happy that the OpenSSL team decided to be proactive and just enable `SSL_OP_SINGLE_DH_USE` for all users, as well as bump the minimum DH key size. Better defaults for everyone!
Re: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
#7Earlier quoted context omitted.
Thanks for the excellent description of the vuln! You mention Apache not being vulnerbale. I just looked through the Nginx code, and it doesn't seem to be vulnerable either because Igor Sysoev enabled SSL_OP_SINGLE_DH_USE back in 2008. https://github.com/nginx/nginx/blob/master/src/event/ngx_eve...
indeed. but there is always Static DH :) even if not so popular...
Ops teams need a clear "should I do emergency patching? yes/no" message when any vulnerability gets published. In this instance, it looks like this doesn't require emergency patching unless you're using something unusual to terminate SSL.
That said, it's a serious issue, no doubt about that.
Re: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
#8> OpenSSL provides the option SSL_OP_SINGLE_DH_USE for ephemeral DH (DHE) in TLS.
It is not on by default. If the option is not set then the server reuses the
same private DH exponent for the life of the server process and would be
vulnerable to this attack. It is believed that many popular applications do set
this option and would therefore not be at risk.
Shouldn't that be "... do NOT ..."?
Edit: Nevermind the double negative got me. Setting the option (which is not on by default) mitigates the issue and they're saying many apps do set it.
Re: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
#9Super happy that the OpenSSL team decided to be proactive and just enable `SSL_OP_SINGLE_DH_USE` for all users, as well as bump the minimum DH key size. Better defaults for everyone!
Yeah, and it looks like BoringSSL did that about a year ago :)
https://boringssl.googlesource.com/boringssl/+/9f226a5f5183e...
Re: OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)
#10Super happy that the OpenSSL team decided to be proactive and just enable `SSL_OP_SINGLE_DH_USE` for all users, as well as bump the minimum DH key size. Better defaults for everyone!
It's about time they did. I always wondered why this was disabled by default.