Communications of the ACM
Researchers Find Same Rsa Encryption Key sed 28,000 Times
Credit: Computerworld
Researchers at Royal Holloway, University of London have found that several million Internet hosts are still vulnerable to the FREAK flaw in the Secure Sockets Layer/Transport Security Layer (SSL/TLS) encryption protocol disclosed earlier this month. As many as a quarter of the hosts on the Internet, about 23 million, were thought to be vulnerable to FREAK when its existence became public on March 3. The Royal Holloway researchers say that when they scanned the entire IPv4 address space last Friday (March 13), about 2.2 million hosts were still accepting the 512-bit encryption keys that are the crux of the FREAK flaw.
The 512-bit keys are vulnerable because it is relatively easy to factor them using the kind of computing power that is readily available today. The researchers also found that many of the hosts, possibly servers or other Internet-connected devices, accepted duplicate 512-bit public keys used by multiple hosts. In one case, nearly 28,000 routers running an SSL virtual private network module were using the same 512-bit public RSA key.
In total, 664,336 of the vulnerable hosts identified by the Royal Holloway researchers were using duplicate keys. The researchers say they are attempting to contact the owners of the at-risk hosts.
From IDG News Service
View Full Article
Abstracts Copyright © 2015 Information Inc., Bethesda, Maryland, USA
No entries found