Subject: Re: [TLS] Still missing: TLS_ECDH_anon_WITH_AES_xxx_GCM_SHAxxx

From: Peter Gutmann <[email-masked]>
Date: Thu, 13 Mar 2014 04:50:32 +0000

Daniel Kahn Gillmor <[email-masked]> writes:

>0) either the software or the admin must manually provision the certificate
>for the server; this means making decisions about questions that don't
>necessarily have any good answers, which is not a situation you want your
>users to be in.  Servers operating in a pool now need to have some sort of
>secret key distribution mechanism, for example.

One option for this is for the server to auto-generate the cert on first
install/setup.  The alternative that's currently used on way too many devices
is for them to have a pre-generated generic cert with incorrect ID information
with the private key shared across all devices.

Peter.

---

From: Alyssa Rowan <[email-masked]>
Date: Thu, 13 Mar 2014 13:22:14 +0000

On 13 March 2014 04:50:32 GMT+00:00, Peter Gutmann <[email-masked]> wrote:

>The alternative that's currently used on way too many
>devices

Can we perhaps make that a SHOULD NOT (or even a MUST NOT), if it somehow isn't already? It's way too common in the wild, and it really is next to useless practice from the same kind of wilful carelessness that brought the world so many default/engineering/field service passwords/backdoors.

The related, but more unwitting, case of devices (often embedded) with bad RNGs which don't collect enough entropy on warmup generating keys on startup which turn out to be one of a globally limited set  of practically-enumerable keys is also one for implementers and testers to watch out for, and is also actively seen and exploited in the wild: I think we should have strong advice about that as it's a depressingly common pitfall.

- --
/akr