Subject: Re: BIND and OpenSSL's RSA signature forging issue

From: Roy Arends <[email-masked]>
Date: Fri, 8 Sep 2006 14:14:59 +0200

Roy Arends/Nominet wrote on 09/08/2006 02:11:02 PM:

> Ben Laurie wrote on 09/08/2006 12:40:44 PM:
> 
> > I've just noticed that BIND is vulnerable to:
> > 
> > http://www.openssl.org/news/secadv_20060905.txt
> > 
> > Executive summary:
> > 
> > RRSIGs can be forged if your RSA key has exponent 3, which is BIND's
> > default. Note that the issue is in the resolver, not the server.
> > 
> > Fix:
> > 
> > Upgrade OpenSSL.
> > 
> > Issue:
> > 
> > Since I've been told often that most of the world won't upgrade
> > resolvers, presumably most of the world will be vulnerable to this
> > problem for a long time.
> > 
> > Solution:
> > 
> > Don't use exponent 3 anymore. This can, of course, be done 
server-side,
> > where the responsible citizens live, allegedly.

> I've created a small keygen package in perl that creates RSASHA1 keys 
> using exponent e=65537
> 
> (for those who can't afford to wait for the patch for isc's 
dnssec-keygen)

Whoops, never mind that comment,

dnssec-keygen from isc has a '-e' option to use a large exponent. 
Apologies for the noise.

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>