Subject: Fwd: Security team successfully cracks SSL using 200 PS3's and MD5 flaw.

From: Marshall Eubanks <[email-masked]>
Date: Sun, 4 Jan 2009 07:51:01 -0500

I think that Hank raises a very good question. There has been
a very active discussion of this on NANOG, both re SSL, BGP and in  
general.

Here is the original link :

<http://hackaday.com/2008/12/30/25c3-hackers-completely-break-ssl-using-200-ps3s/ 

Regards
Marshall

Begin forwarded message:

> From: Hank Nussbacher <[email-masked]>
> Date: January 4, 2009 2:22:06 AM EST
> To: Mikael Abrahamsson <[email-masked]>, "[email-masked]" <[email-masked] 
> >
> Subject: Re: Security team successfully cracks SSL using 200 PS3's  
> and MD5 flaw.
>
> At 06:44 PM 03-01-09 +0100, Mikael Abrahamsson wrote:
>> On Sat, 3 Jan 2009, Hank Nussbacher wrote:
>>
>>> You mean like for BGP neighbors?  Wanna suggest an alternative? :-)
>>
>> Well, most likely MD5 is better than the alterantive today which is  
>> to run no authentication/encryption at all.
>>
>> But we should push whoever is developing these standards to go for  
>> SHA-1 or equivalent instead of MD5 in the longer term.
>
> Who is working on this?  I don't find anything here:
> http://www.ietf.org/html.charters/idr-charter.html
>
> All I can find is:
> http://www.ietf.org/rfc/rfc2385.txt
> http://www.ietf.org/rfc/rfc3562.txt
> http://www.ietf.org/rfc/rfc4278.txt
>
> Nothing on replacing MD5 for BGP.
>
> -Hank
>
>

_______________________________________________
Ietf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Eric Rescorla <[email-masked]>
Date: Sun, 04 Jan 2009 07:56:34 -0800

At Sun, 4 Jan 2009 07:51:01 -0500,
> > Nothing on replacing MD5 for BGP.

Oh boy...

1. This isn't a break in SSL per se. It's an attack on a single
CA which was still unsafely using MD5. As I understand it, they
have now fixed that. So, it's not clear to what extent this has
an ongoing impact. In particular, it only affects certificate-based
authentication, not authentication with a shared secret, as is
used in TCP-MD5.

My summary of the attack can be found
here: http://www.educatedguesswork.org/2008/12/understanding_the_sotirov_et_a.html

2. The MAC used in TCP-MD5 is weak by modern standards (for several
reasons, not just that it uses MD5) and there is already work going
on in TCPM to replace it. See draft-ietf-tcpm-tcp-auth-opt.

-Ekr