On 07/01/2016 16:46, Michael Wojcik wrote:
> As described on that web page, use OpenSSL 1.0.1f or later. That prevents the currently-practical SLOTH attack against RSA-MD5 client authentication.
>
> If you're using an OpenSSL release earlier than 1.0.1f, SLOTH is probably not your biggest problem.
>
> The authors recommend discontinuing use of MD5 and SHA-1 in general. So does nearly everyone else. Really the risk of continuing to support MD5 and SHA-1 can only meaningfully be evaluated in the context of your own threat model; but either you already know that, or you don't know what your threat model is, in which case the safe move is to drop support for MD5 and SHA-1 as soon as you can.
>
The above is not a very accurate summary.
In particular, the following would be a clearer summary:
1. Whenever possible, configure both servers and clients
to avoid using MD5 or SHA-1 alone.
2. My suggestion: If it is necessary to retain SHA-1
support due to some correspondents stuck with older
weak algorithms (looking at you Microsoft!), then
isolate it as much as possible, e.g. with different
certificates etc.
3. If possible, configure servers and clients to not
choose encryption modes where the TLS handshake is
confirmed using only 96 bits of the relevant HMAC.
4. Do not use the "official" tls-unique token to bind
something to a TLS handshake, it is unsuited to purpose,
even with the recent extension of its format.
My suggestion: Instead do a strong hash (SHA-256 or
better) of the complete handshake (all handshake
messages in both directions, including record headers).
Enjoy
Jakob
--
Jakob Bohm, CIO, Partner, WiseMo A/S. https://www.wisemo.com
Transformervej 29, 2860 S?borg, Denmark. Direct +45 31 13 16 10
This public discussion message is non-binding and may contain errors.
WiseMo - Remote Service Management for PCs, Phones and Embedded
