Subject: BIND and OpenSSL's RSA signature forging issue

From: Ben Laurie <[email-masked]>
Date: Fri, 08 Sep 2006 11:40:44 +0100

I've just noticed that BIND is vulnerable to:

http://www.openssl.org/news/secadv_20060905.txt

Executive summary:

RRSIGs can be forged if your RSA key has exponent 3, which is BIND's
default. Note that the issue is in the resolver, not the server.

Fix:

Upgrade OpenSSL.

Issue:

Since I've been told often that most of the world won't upgrade
resolvers, presumably most of the world will be vulnerable to this
problem for a long time.

Solution:

Don't use exponent 3 anymore. This can, of course, be done server-side,
where the responsible citizens live, allegedly.

Side benefit:

You all get to test emergency key roll! Start your motors, gentlemen!

Cheers,

Ben.

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Fri, 8 Sep 2006 13:11:02 +0100

> where the responsible citizens live, allegedly.

I've created a small keygen package in perl that creates RSASHA1 keys 
using exponent e=65537

(for those who can't afford to wait for the patch for isc's dnssec-keygen)

Requirements: Net::DNS and Net::DNS::SEC

Regards,

Roy

---

From: Ben Laurie <[email-masked]>
Date: Fri, 08 Sep 2006 13:59:23 +0100

> Requirements: Net::DNS and Net::DNS::SEC

The "-e" flag to dnssec-keygen also makes it use e=65537.

Cheers,

Ben.

---

From: [email-masked]
Date: Fri, 8 Sep 2006 14:09:24 +0000

> > where the responsible citizens live, allegedly.

	hum...  so when we do upgrade our openssl,,, its still
	prudent to use the large exponent in the default keygen
	stuff in the default BIND tools?  e.g.  the -e flag?

	(thanks for the tool Roy)

--bill

---

From: Ben Laurie <[email-masked]>
Date: Fri, 08 Sep 2006 16:02:48 +0100

> 	stuff in the default BIND tools?  e.g.  the -e flag?

The point is that until _all_ clients upgrade, they're vulnerable. So,
to protect them, you need to not use exponent 3.

Cheers,

Ben.