You are not logged in.
Pages: 1
Hello all,
Quoting from https://arstechnica.com/information-tec … onian-ids/:
A crippling flaw in a widely used code library has fatally undermined the security of millions of encryption keys used in some of the highest-stakes settings, including national identity cards, software- and application-signing, and trusted platform modules protecting government and corporate computers.
The weakness allows attackers to calculate the private portion of any vulnerable key using nothing more than the corresponding public portion
Here is the paper: https://crocs.fi.muni.cz/public/papers/rsa_ccs17
please check your RSA public key against a python app or a web tool: https://keychest.net/roca . If it is vulnerable, revoke it and generate a new one.
Again: send you public key, no need to send your private key to anyone.
It would be awesome if someone can check the archlinux keyring too.
jjd
Offline
Well, this is a lot simpler, actually.
If you have generated your key using a smartcard, you're almost certainly in trouble. Assuming people actually do that, which is mildly silly IMHO.
Managing AUR repos The Right Way -- aurpublish (now a standalone tool)
Offline
Assuming people actually do that, which is mildly silly IMHO.
https://en.wikipedia.org/wiki/Trusted_Platform_Module
It would seem that whole disk encryption could be at risk if the key is generated by the TPM
Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
Sometimes it is the people no one can imagine anything of who do the things no one can imagine. -- Alan Turing
---
How to Ask Questions the Smart Way
Offline
Well, someone on LWN.net ran the software against Debian keyring.. and he found 6 hits.
https://lwn.net/Articles/736530/
EDIT: And a test was necessary.
(pyenv) lolz@strunz ~/Work/roca (master)$ roca-detect /usr/share/pacman/keyrings/archlinux.gpg
2017-10-17 21:40:25 [6976] INFO ### SUMMARY ####################
2017-10-17 21:40:25 [6976] INFO Records tested: 183
2017-10-17 21:40:25 [6976] INFO .. PEM certs: . . . 0
2017-10-17 21:40:25 [6976] INFO .. DER certs: . . . 0
2017-10-17 21:40:25 [6976] INFO .. RSA key files: . 0
2017-10-17 21:40:25 [6976] INFO .. PGP master keys: 93
2017-10-17 21:40:25 [6976] INFO .. PGP total keys: 201
2017-10-17 21:40:25 [6976] INFO .. SSH keys: . . . 0
2017-10-17 21:40:25 [6976] INFO .. APK keys: . . . 0
2017-10-17 21:40:25 [6976] INFO .. JSON keys: . . . 0
2017-10-17 21:40:25 [6976] INFO .. LDIFF certs: . . 0
2017-10-17 21:40:25 [6976] INFO .. JKS certs: . . . 0
2017-10-17 21:40:25 [6976] INFO .. PKCS7: . . . . . 0
2017-10-17 21:40:25 [6976] INFO No fingerprinted keys found (OK)
2017-10-17 21:40:25 [6976] INFO ################################
Last edited by DaNiMoTh (2017-10-17 19:41:28)
Offline
Yubico commented on this. https://www.yubico.com/keycheck/
aur S & M :: forum rules :: Community Ethos
Resources for Women, POC, LGBT*, and allies
Offline
Pages: 1