Re: Fault in openssl-blacklist - version 0.1 -- false negatives.
On May 16, 2008, at 12:48 PM, Dirk-Willem van Gulik wrote:
Just FYI - there seems a minor fault in the openssl-blackist tool, I
strongly suspect
After discussing this with Jamie - two things - First note that above
is NOT the case
provided that you used [1] or more recent - and the therein included
"debian/rules"
script has ran OK and without error.
You can verify this by checking that the head of the two blacklists
files looks like 2
and _not_ like 3 (perhaps this needs a nice checksum at some point).
Secondly - the lists are not entirely complete - so you may still get
false
negatives - Jamie lets know:
The blacklists are made for little-endian 32 bit, little endian 64 bit
and big endian 32 bit (don't have big endian 64 bit). Also, due to
time
constrainsts be32 is only half done. I plan on rolling out the full
1024
and 2048 list today.
So that will be solved later today. So you may want to hold off any
labour
intensive scans.
Thanks,
Dw.
1 https://launchpad.net/ubuntu/hardy/+source/openssl-blacklist/0.1-0ubuntu0.8.04.2
2 head blacklist.ok
# After these initial comments, each line must consist of the lower-
case key
# modulus checksum:
# openssl rsa -noout -modulus -in /tmp/key.pem | sha1sum | cut -d '
' -f 1)
# with the first 20 characters removed (that is, the lower 80 bits of
the
# fingerprint). Unless these rules are followed, the blacklist will
not work
# properly. See openssl-vulnkey(1).
00005890bc78bcbee3ca
0000d80c186767f2473a
0001260681906865947e
...
3 head blacklist.not-ok
# After these initial comments, each line must consist of the lower-
case key
# modulus checksum:
# openssl rsa -noout -modulus -in /tmp/key.pem | sha1sum | cut -d '
' -f 1)
# with the first 20 characters removed (that is, the lower 80 bits of
the
# fingerprint). Unless these rules are followed, the blacklist will
not work
# properly. See openssl-vulnkey(1).
0bdf7fd6b52a2f0157d45f6fba4d283cd951461d
f381feecee302f10ada59730abd94c4ca497be6d
98fc6e7d255fc6e21def70c2d3e3cd17131567d2
...
Reply to: