SoylentNews is people
SoylentNews
The Latacora firm has a blog post asserting that OpenSSH-portable has poor defaults for encrypting private RSA keys because of its reliance on OpenSSL. The blog goes into why this is a problem and how you can test it for yourself.
There is nothing wrong with the generated RSA keys themselves, however, just the encryption of the private RSA keys -- if made using current defaults. There are two ways of encrypting RSA keys, an old and apparently insecure way, and a new key format available but not default. Newer key types like Ed25519 use only the new key format and are not bothered by this problem.
Earlier on SN:
WikiLeaks Unveils CIA Implants That Steal SSH Credentials From Windows, Linux PCs (2017)
Upgrade Your SSH Keys (2016)
OpenSSH 6.8 Will Feature Key Discovery and Rotation for Easier Switching to DJB's Ed25519 (2015)
(Score: 0) by Anonymous Coward on Monday August 06 2018, @06:47PM (3 children)
I haven't used RSA since ed25519 was supported. Libressl seems to be a better choice than OpenSSL too.
(Score: 2) by PocketSizeSUn on Tuesday August 07 2018, @05:09AM (2 children)
Hmmm... is ed25519 compromised?
https://research.kudelskisecurity.com/2017/10/04/defeating-eddsa-with-faults/ [kudelskisecurity.com]
(Score: 0) by Anonymous Coward on Tuesday August 07 2018, @04:48PM
No, that is an implementation problem of a particular signature scheme that uses Ed25519 as a primitive. In fact, if you look at the paper, they can fix the problem by making a slight backwards-compatible tweak to the algorithm, rather than a wholesale change to any of the primitives.
(Score: 1, Informative) by Anonymous Coward on Tuesday August 07 2018, @07:47PM
This article describes a fault injection attack, a type of side-channel attack. It's something you may need to worry about when designing a crypto system but not necessarily an inherent problem with the algorithms.
Note also that RSA, when using the very common CRT optimization, is also trivially vulnerable to similar attacks. The modulus M is the product of two primes p and q. In the CRT optimization, the signer computes two intermediate values, one modulo p and the other modulo q. If an attacker can induce a fault which corrupts one of those intermediate values (just one bit flip will suffice) but not the other, then the resulting signature reveals the prime factors p and q of the modulus, which is a total defeat of RSA.
There are various techniques to avoid fault injection. A simple but expensive method is to compute the signature more than once and only use it if all the computations match. This means the attacker now has to inject the exact same fault more than once; this is (in principle) more difficult for an attacker but it turns out to be ridiculously hard to actually defend against these sort of side channel attacks.