Re: [TLS] Another IRINA bug in TLS

[Florian Weimer <[e-mail]>]

On 05/21/2015 01:31 PM, Santiago Zanella-Beguelin wrote:

> Deprecating non-safe DH primes and having clients test primality of p and (p-1)/2 goes a long way. It doesn't rule out all weak groups or trapdoors.

I need something which prevents MITM attacks and can be applied as a
software update without configuration changes, and without extensive
testing because it is relatively risk-free.

Rejecting handshakes in clients without additional measures risks that
(a) additional handshakes fail, leading to service outages and (b)
clients will fall back no encryption at all (after manual intervention,
or automatically in case of SMTP with STARTTLS and opportunistic
encryption).

I'm not sure if it is feasible to produce a risk-free software update
for this issue.  But, say, rejecting DH primes smaller than 1024 bits is
not, at least not along with other compensating measures.

-- 
Florian Weimer / Red Hat Product Security