![oss-sec logo](/images/oss-sec-logo.png)
oss-sec mailing list archives
Re: Microsoft Warns Customers Away From RC4 and SHA-1
From: "Eric H. Christensen" <echriste () redhat com>
Date: Wed, 13 Nov 2013 11:09:10 -0500
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On Wed, Nov 13, 2013 at 07:57:51AM -0800, Tim wrote:
I'm inclined to agree. The question I suppose is, like DES (and 3DES/MD5) at what point do we start assigning CVE's for some of this? thoughts and comments welcome.Using a weak encyption algorithm alone isn't a sufficient condition to issue a CVE against software, since often the context of the usage matters a lot. If you use MD5 or SHA-1 for password hashing (with lots of salt and rounds), then there's no vulnerability. If you use them for HMACs, then there's also likely no problem. But if you use them for a signature with a public key, there is.
It's answers like this that make it difficult for non-security-literate system administrators to make good decisions. I completely understand and agree with what you wrote but I wonder if we're making it harder for people to understand how to protect themselves. After having many similar conversations with people that manage systems I find that it's usually easier to say "MD5 bad, SHA-256 good" and then just walk away. Perhaps some sort of chart should be published that allows people to make better decisions? - -- Eric - -------------------------------------------------- Eric "Sparks" Christensen Red Hat, Inc - Product Security Team sparks () redhat com - sparks () fedoraproject org 097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1 - -------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) iQGcBAEBCgAGBQJSg6QjAAoJEB/kgVGp2CYvHCoL/0lcSKwfskG9b8ltQoWFfBUF WEVB8JJOa+tfLG66tFFtIJtqBgR4cXK6fVaFu4N5n7J/xJ5ULPdE6OX72njSEH28 4WHi0I8N0otvUe0RPETTKgm5UW4cIFbamc3RGtwYtmA6N0Y2w6Xpzvnu7TAQ2lr7 6tz1gMy1GUKbwDxeyRgVqqAZk5uQp90L4mqPadMXTtqfUtbDX6JOU1lSN6rFd88S IGXMNICDJx3i6ErwJfxyfhLU/GcnLx4g7evTcet/LVR/An6V7FrCMf9PW19Lx5xv CIbHZGxhJDzA1pJ1/h+Oh2X4qGvmV5w5NUMIhdyVH2Mf/4DscxWZS6FpvaBKb0ax WZLWtoC2K9LEyiJq+VYMVMXhLwUy6oTMnenS/yGfdxBHLdI3uP9Sva7E0otdReLo 6qrQVNW0KStL8D8MJ832tJ5jYx01SBQA5l1cUMwHrmGzC+VxE6cDAQ9FUc1v9+8p M/YbSc35J0paRZCpcL9tzQV38fZb/hvO8zbvKJ4zDQ== =MiSz -----END PGP SIGNATURE-----
Current thread:
- Microsoft Warns Customers Away From RC4 and SHA-1 Kurt Seifried (Nov 12)
- Re: Microsoft Warns Customers Away From RC4 and SHA-1 Tim (Nov 13)
- Re: Microsoft Warns Customers Away From RC4 and SHA-1 Eric H. Christensen (Nov 13)
- cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] Daniel Kahn Gillmor (Nov 13)
- Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] Tim (Nov 14)
- Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] Kurt Seifried (Nov 14)
- Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] Chris Palmer (Nov 14)
- Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] Kurt Seifried (Nov 14)
- Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] Chris Palmer (Nov 15)
- Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] Kurt Seifried (Nov 15)
- Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] Marcus Meissner (Nov 15)
- Re: cryptographic primitive choices [was: Re: Microsoft Warns Customers Away From RC4 and SHA-1] Tim (Nov 15)
- Re: Microsoft Warns Customers Away From RC4 and SHA-1 Tim (Nov 13)