Subject: Fwd: Alert: certs with RSA public key exponent of 1

From: Russ Housley <[email-masked]>
Date: Thu, 08 Jan 2004 17:27:54 -0500

This will also be of interest to this list ...

Russ

>Date: Thu, 8 Jan 2004 14:08:34 -0800
>From: "Nelson Bolyard" <[email-masked]>
>Subject: Alert: certs with RSA public key exponent of 1
>To: "IETF Transport Layer Security WG" <[email-masked]>
>
>Some time ago, mozilla was modified to detect and reject RSA keys with
>public exponents equal to 1.  Presumably, the readers of this list
>need no explanation of the implications of such keys.
>
>Now, mozilla users are encountering web sites whose certs have such keys.
>At least one public CA has apparently issued one or more such certs.
>
>I'm reporting this here to alert the readers of this list who may wish
>to ensure that their implementations detect such keys, and to suggest
>that perhaps the TLS RFC should explicitly forbid the use of any public
>keys (RSA or otherwise) that facilitate such weak encryption and/or
>authentication by requiring implentations to detect and reject them.
>
>Nelson    (not speaking for my employer)