On Fri, Aug 8, 2008 at 7:54 PM, Tim Dierks <tim@xxxxxxxxxx> wrote: > Using this Bloom filter calculator: > http://www.cc.gatech.edu/~manolios/bloom-filters/calculator.html , plus the > fact that there are 32,768 weak keys for every key type & size, I get > various sizes of necessary Bloom filter, based on how many key type / sizes > you want to check and various false positive rates: > * 3 key types/sizes with 1e-6 false positive rate: 2826759 bits = 353 KB > * 3 key types/sizes with 1e-9 false positive rate: 4240139 bits = 530 KB > * 7 key types/sizes with 1e-6 false positive rate: 6595771 bits = 824 KB > * 7 key types/sizes with 1e-9 false positive rate: 9893657 bits = 1237 KB > > I presume that the first 3 & first 7 key type/sizes in this list > http://metasploit.com/users/hdm/tools/debian-openssl/ are the best to > incorporate into the filter. > > Is there any chance it would be feasible to get a list of all the weak keys > that were actually certified by browser-installed CAs, or those weak > certificates? Presumably, this list would be much smaller and would be more > effectively distributed in Bloom filter form. Or as a CRL :-)
