OpenSSL fixes encryption vulnerabilities and strengthens logjam defenses

Source: TechTarget China Michael Heller Translator: Zhang Chengcheng

The OpenSSL project team released patches for its password vault to fix a serious vulnerability that could allow an attacker to decrypt HTTPS traffic, while hardening the defenses against logjam.

The decryption attack vulnerability is discovered when the DH key exchange is handled by OpenSSL in certain specific cases. In general, OpenSSL uses so-called "safe" prime numbers only, but in OpenSSL1.0.2, a new way of generating the parameter file will re-enable a prime number. In theory, an attacker could use this value to decrypt encrypted secure communications.

However, there is a consultant who points out that this attack is difficult to implement because it requires "the attacker to complete multiple signal exchanges when the same DH index is used by the same person".

Micro Focus Solutions architect Garve Hays says the risk is limited because it is exposed to services that primarily provide forward secrecy, such as Gmail, Twitter, and Facebook.

"The good news is that these companies are diligent in patching, so the risks will soon be under control," Hays said. The Forward secrecy its protocol attribute is that the message is not allowed to be decrypted with the private key. Therefore, when the private key is acquired, it cannot be used to rewind and restore the old communication. ”

OpenSSL1.0.1 is not vulnerable to this attack, and users who use the 1.0.2 version need to install OpenSSL1.0.2 patches as early as possible.

The new patch also adds some new features to further reduce the impact of the Logiam attack. Logiam allows a man-in-the-middle attacker to make vulnerable TLS connections more vulnerable. Prior to the OpenSSL patch to defend against the attack by rejecting the information exchange of the parameter under 768 bits, the new patch reinforces the protocol, rejecting the exchange of information for parameters under 1024 bits.

OpenSSL fixes encryption vulnerabilities and strengthens logjam defenses