Recently discovered predictable RSA and DSA key generation vulnerabilities occurring in Debian OpenSSL packages[1][2]. As many Linux distributions are based of Debian derived distributions like the popular Ubuntu, Knoppix, Kubuntu distributions, there are a significant number of vulnerable RSA and DSA private keys around now.

SSH keys generated on Debian distros have these vulnerabilities too. This will affect SSH system administrators and users. These users should refer to available advice[3]. The rest of this advisory will focus on key and X509 certificate implications.

Description:

Users and system administrators generate RSA and DSA keys for a large number of applications[4]. Those who have OpenSSL, or any of the many applications that use OpenSSL libraries, on vulnerable platforms are affected. Those systems that allow remote access as a result of a user provided vulnerable public key may also be at risk of unauthorized access.

How is CAcert affected?

Luckly, the CAcert Root Class 1 and 3 keys are not affected as these were generated before the vulnerability was introduced into Debian[3] in September 2006. The process that signs CSR (certificate signing requests) and therefore all signed public keys does not use any key generation, so they are not affected by CAcert. Conclusion: CAcert does NOT have to reissue every signed certificate.

But if you have generated a new certificate later as August 2006 and used OpenSSL on a Debian system please read on. First is explained what actions have been undertaken by CAcert in order to recover from this vulnerability event. If you used Debian this may help you as well.

CAcert is using Debian OS and so CAcert’s internal systems were affected, as they generated predictable RSA and DSA keys for internal use, eg ssh authorized_keys for remote system administration. As SSH access is restricted to only to a few static configered IP addresses this posed only a very low risk.

The server certificates of servers like https://www.cacert.org and https://secure.cacert.org were affected by a poor key. CAcert has replaced those keys.

How can servers and clients be affected and what should you do now?

Please refer to our Debian Vulnerability Handling wiki page.

Daniel Black, system administrator for CAcert

[1] http://www.debian.org/security/2008/dsa-1571 Debian Security Advisory
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0166
[3] http://www.debian.org/security/key-rollover/
[4] http://wiki.cacert.org/wiki/DebianVulnerabilityHandling

The Open Rights Group [1] are holding a keysigning party [2] in London
on Monday the second of June.

It’ll be a chance for those interested in CACert to give and/or gain
some points, as well as get their PGP key signed.

[1]http://www.openrightsgroup.org/
[2]http://tinyurl.com/6z4273

Regarding the recently discovered random number vulnerability:

CAcert’s root keys are not affected, since they were created before the bug existed.
CAcert’s internal systems were affected, and are currently being cleaned up.
A lot of our users are affected.
We are currently working on improved methods to detect the vulnerabilities and inform the affected users about them.
In general, digital signatures and certificates are only affected in the case the any of the underlying keys are compromised. Signatures and certificates do not contain any additional random numbers, so they can’t be affected on their own, if the keys are not compromised.

We currently think that the articles in the media hasn’t informed everyone about the whole impact of the problem yet.

The affected distributions contain Debian, Ubuntu, Kubuntu, Knoppix, Grml, and various other Debian based distributions.
Also various embedded systems that are based on Debian are likely affected.

Regarding the applications, OpenSSL, OpenVPN, OpenXPKI, OpenCA, OpenSSH (especially client authorisation keys!), boxbackup and various other software packages are affected.

All systems that are relying on keys that were generated on affected systems are affected.
This means that you should scan all your SuSE, Fedora, Redhat, BSD, … SSH-servers for compromised keys in the authorized keys files of all users, and blacklist the compromised keys accordingly. (And the same for any other services that might rely on the compromised keys.)

If you want to assess the quality of your own random number generator, you can use our free service here:
http://www.cacert.at/random/

We are currently developing a X.509 vulnerability detection system, which will be available for all CA’s, to discover similarly compromised keys as early as possible. If you want to participate and help there, please contact us.
http://wiki.cacert.org/wiki/HashServer

Message to all non-Debian-derived vendors: Please ship blacklists and blacklist-detection software in your security updates. (Port ssh-vuln to your distribution, …) And warn your users too, not to rely on compromised keys anymore.

General information about the vulnerability:

http://wiki.debian.org/SSLkeys
http://www.debian.org/security/key-rollover/
http://www.debian.org/security/2008/dsa-1571

Luciano Bello discovered that the random number generator in Debian’s openssl package is predictable. This is caused by an incorrect Debian-specific change to the openssl package (CVE-2008-0166). As a result, cryptographic key material may be guessable.

[…more]