Peter Saint-Andre
05-13-2008, 04:35 PM
A serious vulnerability in Debian GNU/Linux was announced today
regarding SSL keys generated on Debian machines using OpenSSL:
http://lists.debian.org/debian-security-announce/2008/msg00152.html
This is just a quick note that the announced vulnerability does not
affect certificates generated by the XMPP Intermediate Certification
Authority (ICA) running at <https://www.xmpp.net/>.
Although all of the machines in the jabber.org/xmpp.org/xmpp.net
infrastructure run on Debian, the certificates and certificate signing
requests (CSRs) issued by the XMPP ICA are not generated on any of those
machines. Instead, if you have obtained a certificate using the XMPP ICA
you had a choice of:
(1) generating your own CSR; in this case if you did so on a Debian
machine then your certificate may be weak...
or:
(2) having the root CA (StartCom) generate the CSR for you; in this case
your CSR was generated by a real hardware random number generator which
feeds the entropy pool as opposed to a pseudo random number generator
which mimics that behavior in software.
If you have any questions about this matter, feel free to contact me
directly.
This notice is also posted here:
https://www.xmpp.net/news/2008/05/13/xmpp-ica-certificates-and-debian-openssl-vulnerability
Peter
--
Peter Saint-Andre
https://stpeter.im/
regarding SSL keys generated on Debian machines using OpenSSL:
http://lists.debian.org/debian-security-announce/2008/msg00152.html
This is just a quick note that the announced vulnerability does not
affect certificates generated by the XMPP Intermediate Certification
Authority (ICA) running at <https://www.xmpp.net/>.
Although all of the machines in the jabber.org/xmpp.org/xmpp.net
infrastructure run on Debian, the certificates and certificate signing
requests (CSRs) issued by the XMPP ICA are not generated on any of those
machines. Instead, if you have obtained a certificate using the XMPP ICA
you had a choice of:
(1) generating your own CSR; in this case if you did so on a Debian
machine then your certificate may be weak...
or:
(2) having the root CA (StartCom) generate the CSR for you; in this case
your CSR was generated by a real hardware random number generator which
feeds the entropy pool as opposed to a pseudo random number generator
which mimics that behavior in software.
If you have any questions about this matter, feel free to contact me
directly.
This notice is also posted here:
https://www.xmpp.net/news/2008/05/13/xmpp-ica-certificates-and-debian-openssl-vulnerability
Peter
--
Peter Saint-Andre
https://stpeter.im/