Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

Cryptographic weakness on Debian systems

Posted May 13, 2008 15:17 UTC (Tue) by hmh (subscriber, #3838)
In reply to: Cryptographic weakness on Debian systems by jwb
Parent article: Cryptographic weakness on Debian systems

I suggest studying the utility mentioned in the advisory that verifies whether a key is weak
or not.  That goes directly to the effect of whatever bug is in question (which is what
matters, here).

(Log in to post comments)

Posted May 13, 2008 15:59 UTC (Tue) by hmh (subscriber, #3838) [Link]

The key vulnerability check basically hashes the key and searches for it in a blacklist of
256Ki entries.  The code says that blacklist is not known to be the complete set of weak keys,
it could be just a subset.

Further comments of that really means depend on studying the OpenSSL code at depth, which I
hope someone will disclose soon.