Should openssl accept weak DSA/DH keys with g = +/- 1 ?

[Georgi Guninski <guninski () guninski com>]

Not on list.

I am a noob at crypto.

IIRC similar attack was used against Tor
several years ago.

In DSA it is possible to force g=1 or g \equiv -1 \mod p.
The first is unit and the second is of multiplicative
order 2.

This are clearly weak and insane choices,
but this might have implications to MITM
(might be wrong on this).

For DH could generate key with g=1, though
couldn't test it.

Tested both 1 and -1 cases in DSA,
the probability of successful connection
was about 1/4 (or maybe 1/2), errors in the
other cases. (for $1$ I would expect probability
$1$).

Attached are cacert.pem and cacert2.pem,
the magic word is 1234.

To test:
$ openssl s_server -accept 8888 -www -cert cacert.pem
$ openssl s_client -connect localhost:8888 -showcerts

To examine
$openssl x509 -text -in cacert2.pem
$openssl dhparam -text -in dHParam.pem

(not sure if dHParam.pem this is usable, forged generation).

Firefox refuses connections, Konqueror works
with same probability.

Suspect this might be related to EC refusing
the point at infinity.

Might have MITM implications, don't have
working exploit (If a MITM can forge $g=1$ in DH,
the private keys are useless).

Attachment: cacert.pem
Description:

Attachment: cacert2.pem
Description:

Attachment: dHParam.pem
Description: