Crippling Crypto: The Debian Openssl Debacle presented at The Last HOPE 2008

by Dino Dai Zovi (Trail of bits), Karsten Nohl, Jacob Appelbaum,

Tags: Security Panel Cloud

Summary : In May 2008, a weakness in Debian was discovered which makes cryptographic keys predictable. A Debian-specific patch to OpenSSL broke the pseudo-random number generator two years ago, which led to guessable SSL and SSH keys. The vulnerability allows for impersonation of secure servers, as well as the potential to login to SSH secured systems. Since many popular derivatives like Ubuntu and Xandros are affected, the weak keys are found all over the Internet. The panel will present their approach to generating lists of weak keys using cloud computing and explain how they collected large numbers of SSL certificates of which several thousand are weak.