Dual EC: A Standardized Back Door [pdf]

Re:Dual EC: A Standardized Back Door [pdf] by tptacek on Saturday August 01, 2015 @11:01AM (#9987227)

All of these banners are from the "Red Hat Secure Web Server". I don't know what that is, but someone else here might.

I'd be interested in finding out more about Red Hat Secure Server:

* It switched from OpenSSL to BSAFE-C in/around 2000

* RSA defaulted BSAFE to Dual_EC in 2004

* The last release I can see for Red Hat Secure Web Server is in 2003

* Red Hat Secure Web Server is EOL'd now.

A helpful Twitter points out this mailing list post from 2003:

http://blog.gmane.org/gmane.linux.redhat.security.server

... in which it's stated that Red Hat Secure Web Server had been EOL for some time.

It's looking more likely that those Shodan banners are not TLS implementations with Dual_EC defaults.

[ Parent | on HN ]

Re:Dual EC: A Standardized Back Door [pdf] by MiWDesktopHack on Sunday August 02, 2015 @04:23AM (#9990144)

Hi Thomas,

Thank for following this up. I think you are right. RH SWS was EOL before the Dual_EC default switch was made. If the only public banners for this product are from before this time, I will conceed that DUAL_EC likely never saw use on the Public Internet.

Pls unblock me on twitter ;-)

[ Parent | on HN ]

Re:Dual EC: A Standardized Back Door [pdf] by tptacek on Sunday August 02, 2015 @01:30PM (#9991466)

I don't think I block you on Twitter.

[ Parent | on HN ]

Re:Dual EC: A Standardized Back Door [pdf] by MiWDesktopHack on Monday August 03, 2015 @05:51AM (#9994726)

twitter: _MiW i said something silly and you blocked me. lets move on and continue an intellectual dialog

[ Parent | on HN ]