Category Archives: Information

General news/information to the CAcert community or about security in general

Sichere E-Mails mit Zertifikaten von CAcert / Secure emails with certificates from CAcert

[English Version below]

Sicherer Mailverkehr ist zurzeit in aller Munde. Mittlerweile stehen mehrere kostenpflichtige Dienste zur Verfügung mit denen Anwender größtenteils pseudo-sichere oder bei einigen Angeboten teilweise auch sichere Mails versenden können.
Tatsächlich sichere E-Mails bedeutet den Einsatz von Ende-zu-Ende-Verschlüsselung, doch auch die kostenpflichtigen Anbieter bieten an dieser Stelle auch keine Hilfestellung für den Benutzer. Wichtig ist, dass die Verschlüsselung im E-Mail-Programm des Anwenders eingerichtet wird.
Übersehen wird dabei oft, dass Sicherheit kostenlos zu haben ist. Und dafür braucht auch kein neues E-Mail-Konto eingerichtet werden: Client-Zertifikate von CAcert integrieren sich nahtlos in alle gängigen E-Mail-Programme unter Windows, Mac und Linux.
PM-Sichere-Emails-de

[English Version]
Secure sending and receiving of email is currently highly demanded. There are a number of paid services nowadays offering pseudo-secure (which turns finally out to be non-secure) or sometimes even secure mails.
But secure mails actually mean end-to-end-encryption. But even services with costs are not able to support users at this point. Important is, that encryption is set up in the mail program of the user.
It is often overseen, that security is available for free. And it even works with the email provider of your choice: client certificates of CAcert integrate seamlessly into most well-known mail programs under windows, mac and linux.
PR-Secure-Emails-en

CAcert enforces rules for signing certificates / CAcert verschärft die Regeln beim Signieren von Zertifikaten

[German version below]

The software team released a patch which forces the user to use a key strength of at least 2048 bit for the certificate. The key strength is given by the CA/Browser forum baseline requirements [1].
During the test prior of the implementation it showed up, that keys using DSA with at least 2048 bit are not processed by the used OpenSSL configuration.
Since there is no easy way to verify the used key parameters for ECDSA are in conformance with the needed security level it has been decided not to support the singing of ECDSA keys until there is a proper solution.
Therefore no keys using DSA or ECDSA will currently be signed.
If a certificate is renewed and an error pointing to the key strength is given you need to create a new certificate with the apropriate key strength and method which is currently only RSA with at least 2048 bit key strength.

[German]
Das Software-Team hat einen Patch veröffentlicht, der den Anwender auffordert, bei der Erstellung eines neuen Zertifikats mindestens eine Schlüsselstärke von 2048 Bit zu verwenden. Diese Einschränkung beruht auf den Baseline Requirements des CA/Browser Forum [1].
Während des Testens vor der Auslieferung ist aufgefallen, dass mit der benutzten OpenSSL-Konfiguration DSA-Schlüssel mit einer Schlüsselstärke von mindestens 2048 Bit nicht korrekt signiert werden können.
Da ferner für ECDSA keine einfache Möglichkeit besteht, die verwendeten Schlüsselparameter auf das Sicherheitsniveau hin zu überprüfen, wurde entschieden, bis eine vertretbare Lösung gefunden ist, keine weiteren ECDSA-Schlüssel zu signieren.
Daher können bis auf weiteres keine DSA- und ECDSA-Schlüssel signiert werden.
Falls beim Erneuern eines Zertifikates ein Fehlerhinweis mit dem Thema nicht ausreichende Schlüsselstärke angezeigt wird, muss ein neuer Schlüssel mit der passenden Methode und Schlüsselstärke erzeugt werden. Zur Zeit sind das nur RSA Schlüssel mit mindestens 2048 Bit Schlüsselstärke.

[1] https://cabforum.org/wp-content/uploads/Baseline_Requirements_V1_1_6.pdf

CAcert and OpenPGP party at Madrid (Spain)

CAcert and OpenPGP party in Madrid (Spain), on Wednesday 19 March

More details below in spanish.

IV Fiesta de firmas OpenPGP y verificación CAcert

Después de la última fiesta de firmas celebrada hace un par de años, os invitamos de nuevo a traer vuestras claves y formularios para compartirlas y verificaros ante CAcert

Fecha: 19/03/2014 de 12:15 a 13:30
Lugar: Salón de Actos del Edificio de Gestión Universidad Rey Juan Carlos
Para más información, ver la página del evento.

Infrastructure Services Moved to New Server

If you have used any infrastructure services (like wiki, blog, translation system, bug tracker) in the last days, you’ve probably noticed that they feel much more responsive. That’s because we have moved those services to a new machine, kindly donated by Thomas Krenn as part of their open source initiative. The donation actually took place some months ago, but we needed some time for preparation so that it’s finally online now. That was about time, because the old machine only had about 1.2 Gigabytes of storage left and those poor services were screaming for help.

Thank you Thomas Krenn for the hardware and also thanks to the admins, especially Jan Dittberner but also all other people involved, for preparing the move.

CAcert with new signature algorithm

From now on, certificates from CAcert are signed with SHA512 as signature hashing algorithm. Doing so, CAcert improves the security of newly issued certificates over the previously used, usual standard in the industry for certificate authorities. Formerly created certificates remain valid of course. Due to limitations in Microsoft Windows XP without Service Pack 3 the new signatures cannot be validated there. An update to at least Microsoft Windows XP with Service Pack 3 or better (e.g. Linux) eliminates this limitation.

CAcert cracks record of issuing 1 million certificates

The community-based certificate authority CAcert issues the 1 millionth certificate.

In the time of insecurity protection of data privacy is particularly important. The best data protection starts where no more data than necessary for service delivery is stored. This is a basic principle for the activity of CAcert. In doing so CAcert performs all important services of commercial vendors: server certificates for protecting web and email connections, client certificates for signing and easy and at the same time effective encryption of email, for authentication and for code signing are certificate options CAcert offers for everybody.

This includes the great work of the community. They help CAcert to issue certificates free of charge and to be an extremely successful internationally active certificate authority. Right now CAcert has issued its 1 millionth certificate with helps users all over the world protecting their sensitive data.

CAcert at the 30C3 (30th Chaos Communication Congress)

The Chaos Communication Congress is an annual meeting of the international hacker scene, organized by the Chaos Computer Club. It will take place from the 27th untill the 30th of december in the Congress Center Hamburg in Hamburg, Germany. The congress features a variety of lectures and workshops on technical and political issues.

CAcert will be present at the 30C3 (27th – 30th december at the CCH Hamburg). Meet us at the Cryptoparty / NoisySquare assembly in area Garderobe Saal 2. Qualified CAcert assurers will be around.

We have also plans to organize a CAcert project meeting. Check out the CAcert project on the 30C3 wiki or the table of self-organized sessions to stay up-to-date.

 

CAcert server move completed on December 12, 2013

The move of all existing CAcert servers  to a new smaller rack at the current hosting centre has completed, mostly successful, on December 12 at 23:00 UTC. All main services are available again now, but we still have some smaller problems to sort out, mostly due to the switch-over to a new much more compact firewall with a completely new architecture.

So please bear with us while we iron out the remaining problems, and feel free to report any issues you are still encountering.

Please join me in expressing thanks to the team that worked very hard over four hours after an already stressful day to get this major job completed: Stefan Kooman, Mendel Mobach, Martin Simons.