Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.project > #9535

Re: Security advisory for YubiKey 4: RSA generation broken

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Mon, 2017-10-16 at 21:06 +0200, Christian Seiler wrote:
> Unfortunately, as far as I understand it, there's no easy method for
> detecting these kinds of broken keys without actually attempting to
> factorize them - and while that's feasible (hence the vulnerability)
> it is still quite expensive - so there is currently no easy method of
> scanning through the Debian keyring for affected keys.

Actually that's wrong, the generation process leaves “fingerprints” which can
be used to identify keys. See for example:

https://keychest.net/roca
https://github.com/crocs-muni/roca

These tools have been used to identify three vulnerable (sub)keys in the
Debian keyring (this is already been taken care of).

Regards,
-- 
Yves-Alexis

Back to linux.debian.project | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Security advisory for YubiKey 4: RSA generation broken Christian Seiler <christian@iwakd.de> - 2017-10-16 21:10 +0200
  Re: Security advisory for YubiKey 4: RSA generation broken Yves-Alexis Perez <corsac@debian.org> - 2017-10-16 21:20 +0200
    Re: Security advisory for YubiKey 4: RSA generation broken Christian Seiler <christian@iwakd.de> - 2017-10-16 21:40 +0200
    Re: Security advisory for YubiKey 4: RSA generation broken Jonathan McDowell <noodles@earth.li> - 2017-10-16 21:50 +0200
  Re: Security advisory for YubiKey 4: RSA generation broken Antoine Beaupré <anarcat@orangeseeds.org> - 2017-10-16 21:30 +0200
    Re: Security advisory for YubiKey 4: RSA generation broken Marc Haber <mh+debian-project@zugschlus.de> - 2017-10-17 09:20 +0200
  Re: Security advisory for YubiKey 4: RSA generation broken NIIBE Yutaka <gniibe@fsij.org> - 2017-10-18 03:40 +0200

csiph-web