Re: [TLS] New drafts: adding input to the TLS master secret

[Eric Rescorla <[e-mail]>]

At Tue, 9 Feb 2010 15:54:33 +0100 (MET),
> > 
> >                                  If you're a TLS server and you
> > just do static RSA, then it is safe to do TLS even without
> > a good source of entropy. On the other hand, if you're doing
> > DHE or you're a TLS client doing static RSA, then it's pretty
> > hard to have a secure system unless you can muster enough
> > entropy to make exhaustive search of the entropy space
> > infeasible.
> 
> 
> I would be careful with such a statement.  The most difficult
> part about the OpenSSL debian problem wasn't about getting OpenSSL fixed,
> it was about replacing all the low-entropy keypairs / server certificates
> that had been generated.  The majority of Browsers, and therefore the
> entropy in the RSA premaster secrets, did never have this particular
> Debian randomness problem. Sessions were affected through the
> lack-of-protection on the TLS key-exchange (RSA premaster secret encrypted
> with a low-entropy server key).  So if you have a TLS server without a
> good source of entropy, you definitely should create the server's keypair
> someplace else and transfer both, server key and cert onto that device
> rather than having the device create its own keypair.

Yes, of course.

-Ekr