Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: domain of chip@force-elite.com designates
 72.232.80.58 as permitted sender)
Message-ID: <482A05A5.6050804@force-elite.com>
Date: Tue, 13 May 2008 14:18:29 -0700
From: Paul Querna <chip@force-elite.com>
User-Agent: Thunderbird 2.0.0.14 (Macintosh/20080421)
MIME-Version: 1.0
To: dev@httpd.apache.org
Subject: Impact of OpenSSL Randomness issues on Debian
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

If you are just catching up:
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0166
http://it.slashdot.org/article.pl?sid=08/05/13/1533212

Most of the talk has been about how SSH Servers and Client private keys 
are vulnerable.

However, Private x509 Keys generated by a vulnerable machine, and used 
by HTTPS are also guessable.

Debian and Ubuntu have made several tools to detect weak key signatures 
in OpenSSH and OpenVPN.

1) Shouldn't it be possible to write something that detects the weak 
private key fingerprint from the SSL handshake?

2) Should we remind users on announce@httpd or another medium, that any 
x509 keys generated on an debian or ubuntu server, such as those used 
for HTTPS, in the last 2 years, should be re-generated?

Thanks,

-Paul