[cl-plus-ssl-devel] [CL-PLUS-SSL-DEVEL][PATCH] call SSL_CTX_set_tmp_rsa_callback to support ephemeral ciphers

[Faré]

On Wed, Feb 5, 2014 at 8:18 PM, Kari Lentz <kari.k.lentz at gmail.com> wrote:
> This was just run on a Hunchentoot web server running Linux 3.2.0.54-generic
> kernel using SBCL 1.1.0.  A Windows NT machine with only standard export
> ciphers was used as the client.  With the COND error, there was
> communication with the Hunchentoot web server but the negotiated key length
> was always 1024 characters.  After the fix of the COND error, there was now
> communication using a key length 512 characters.  It looks like 512
> character key length communication had always been available with the above
> setup but the error caused only 1024 length keys to be used.

512 bit RSA keys are broken. The NSA is supposed to be able to do so
casually, and
other big malfeasants too (Chinese government, Russia Mafia, etc.).
Even 1024 bit RSA keys are generally considered broken, though
somewhat expensive to break.
It is not a good idea to use RSA keys smaller than 2048 bit.
I don't know if SSL allows such key size. If not, we're all f*cked.

Also, the default Elliptic Curves used, as invented by the NSA and
recommended by NIST,
such as secp256r1, are suspected to be backdoored by the NSA and you
should use other ones,
if you can. If SSL can't use alternative, safer, curves, we're all f*cked, too.
Though as long as they can keep their secrets (ha!), only the NSA can
read your messages, then.

—♯ƒ • François-René ÐVB Rideau •Reflection&Cybernethics• http://fare.tunes.org
So capitalism has been making everyone poorer for centuries?
How fabulously rich our ancestors must have been before all this destruction!