[kwlug-disc] Stronger SSH keys and SSL certificates

[unsolicited]

The very nature of Open Source is such that that is not possible.

The source is free to see, use, modify, whatever.

And people do.

As I understand it, that is how Heartbleed was discovered - by code review.

If any such back door were present, the community would refuse to use 
it. The very act of putting in any such back door would thus be 
self-defeating - nobody would use it, there would be no door, back or 
otherwise, to enter.

People compile from source.

Source is retrieved from trusted repositories.

Repositories have gpg keys, things are checksummed.

You may upgrade with binaries, but those binaries have come from trusted 
repositories.

Each combination has their own binary. Or they build their own from 
trusted source, themselves.

Thus, many instances of running software around the world are 
simultaneously and independently run, many of which are independently 
compiled and built from the same source.

Depending upon the app, someone sticking something in in one place, will 
either be immediately rejected, or rendered neuter by nothing compatible 
with it. i.e. Send a request (for back door entry) would be denied 
because nothing understands the request, or try to use an algorithm that 
lets you derive a back door and it would be denied because nobody would 
send you a key with this algorithm they do not themselves have.

All of this web of trust is quite probably the single biggest advantage 
(if the least understood by those new to computers) of non-proprietary 
systems. When you update through your repository, you KNOW it's good 
code. Not to say stuff doesn't creep in, or at least try to. But any 
reasonably reputable repository, once such is identified to them, shuts 
it down pretty damn quick.

OpenSSL, for example, is paid attention to really rather diligently. The 
world depends upon it, so anything threatening it gets immediate 
attention. (Even if it takes a while to trickle down to the end user.)


On 14-04-20 01:59 PM, CrankyOldBugger wrote:
> I would have to wonder, that if the NSA has some sort of back door or trick
> to crack openSSL at 1024 bits, then they would probably have the same
> backdoor or trick for 2048 or more bits.  Just a thought, I'm certainly not
> trying to put down the idea of using encryption!
>
>
>
> On 20 April 2014 13:50, Jonathan Poole <jpoole at digitaljedi.ca> wrote:
>
>> Oh and of course, ensure you’re using an openssl version not affected, or
>> patched.
>>
>> On Apr 20, 2014, at 1:47 PM, Jonathan Poole <jpoole at digitaljedi.ca> wrote:
>>
>> How paranoid do you want to be?
>>
>> At least 4096 IMHO, Computers are faster/stronger/ these days, higher bits
>> shouldn’t generate too much load decrypting.
>>
>> if you want, generate a new cert everyday if you want.
>>
>> *openssl genrsa -out ca.key 4096*
>>
>> *openssl req -new -x509 -days 180 -key ca.key -out ca.crt*
>> On Apr 20, 2014, at 1:12 PM, Khalid Baheyeldin <kb at 2bits.com> wrote:
>>
>> Needless to say that recent events and government actions warrants more
>> paranoia ...
>>
>> So, to that effect, what options should one use to have the SSH keys
>> stronger?
>> How many bits? What options for ssh key gen should be used?
>>
>> And for SSL certificates, what options do you use to make the certificates
>> as strong as they can be?
>> For example, I use the following script for self signed certificates. How
>> can this be improved?
>>
>> #!/bin/sh
>>
>> KEY=server.key
>> REQ=server.csr
>> CRT=server.crt
>>
>> cd ~/cert
>> # Generate a key
>> openssl genpkey -algorithm rsa -out $KEY
>> # Generate a certificate signing request
>> openssl req -new -sha1 -nodes -key $KEY -out $REQ
>> # Create a self signed certificate
>> openssl x509 -req -days 365 -in $REQ -signkey $KEY -out $CRT
>> # Copy it to the server
>> cp $CRT /etc/ssl/certs
>> cp $KEY /etc/ssl/private
>>
>>
>> --
>> Khalid M. Baheyeldin
>>
>>
>
>
>
> _______________________________________________
> kwlug-disc mailing list
> kwlug-disc at kwlug.org
> http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org
>