Fedora/Redhat and perfect forward secrecy

[Reindl Harald]

https://bugzilla.redhat.com/show_bug.cgi?id=319901

looks like Redhat based systems are the only remaining
which does not support EECDHE which is a shame these
days in context of PRISM and more and more Ciphers
are going to be unuseable (BEAST/CRIME weakness)
______________________________________________________________

https://bugzilla.redhat.com/show_bug.cgi?id=960193
>  ECC will be supported on RHEL-6.5 and will also be
>  part of the planned FIPS-140 revalidation 
so what is here state of play for Fedora?
______________________________________________________________

https://www.google.at/search?q=postfix+EECDHE
https://www.google.at/search?q=%22EECDHE-RSA%22

http://en.wikipedia.org/wiki/Elliptic_curve_Diffie%E2%80%93Hellman
http://en.wikipedia.org/wiki/Perfect_forward_secrecy

[Heinz Diehl]

On 26.08.2013, Alchemist wrote: 

>  Very good discussion. This is an important issue.  OpenSSL with
> Elliptic
>  Curve was added to the http://rpmfusion.org/Wishlist, but the question
>  remains open 
Is the crypto the real problem (=weakest link), or is it something else? I
guess that would be the relevant question prior to new algorithms.

Of course, the question remains still open wrt storing the complete
data transfer over many years. On the other hand, data is more likely
to get unimportant as time goes by.

[D. Hugh Redelmeier]

| From: Reindl Harald <h.reindl(a)thelounge.net&gt;
| Date: Sat, 24 Aug 2013 11:38:21 +0200

| https://bugzilla.redhat.com/show_bug.cgi?id=3D319901
| 
| looks like Redhat based systems are the only remaining
| which does not support EECDHE which is a shame these
| days in context of PRISM and more and more Ciphers
| are going to be unuseable (BEAST/CRIME weakness)

It might be the case that the NSA has their fingers in these ECC
standards.

Here's a Schneier article worth reading:
 
<http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-sur...

In it, he recommends (among many other things):

    Prefer conventional discrete-log-based systems over elliptic-curve
    systems; the latter have constants that the NSA influences when
    they can.

It could be (by accident) that Fedora is more secure due to patents!

[Reindl Harald]

Am 06.09.2013 23:31, schrieb D. Hugh Redelmeier:
>  | From: Reindl Harald <h.reindl(a)thelounge.net&gt;
>  | Date: Sat, 24 Aug 2013 11:38:21 +0200
>  
>  | https://bugzilla.redhat.com/show_bug.cgi?id=3D319901
>  | 
>  | looks like Redhat based systems are the only remaining
>  | which does not support EECDHE which is a shame these
>  | days in context of PRISM and more and more Ciphers
>  | are going to be unuseable (BEAST/CRIME weakness)
>  
>  It might be the case that the NSA has their fingers in these ECC
>  standards.
>  
>  Here's a Schneier article worth reading:
>   
> <http://www.theguardian.com/world/2013/sep/05/nsa-how-to-remain-secure-sur...
>  
>  In it, he recommends (among many other things):
>  
>      Prefer conventional discrete-log-based systems over elliptic-curve
>      systems; the latter have constants that the NSA influences when
>      they can.
>  
>  It could be (by accident) that Fedora is more secure due to patents! 
it could be that RHEL/Fedora fail every security audit in the near future
*that* is proven and sure, the above not!

[Alchemist]

2013/8/24 Reindl Harald <h.reindl(a)thelounge.net&gt;

>  https://bugzilla.redhat.com/show_bug.cgi?id=319901
>
>  looks like Redhat based systems are the only remaining
>  which does not support EECDHE which is a shame these
>  days in context of PRISM and more and more Ciphers
>  are going to be unuseable (BEAST/CRIME weakness)
>  ______________________________________________________________
>
>  https://bugzilla.redhat.com/show_bug.cgi?id=960193
>  > ECC will be supported on RHEL-6.5 and will also be
>  > part of the planned FIPS-140 revalidation
>
>  so what is here state of play for Fedora?
>  ______________________________________________________________
>
>  https://www.google.at/search?q=postfix+EECDHE
>  https://www.google.at/search?q=%22EECDHE-RSA%22
>
>  http://en.wikipedia.org/wiki/Elliptic_curve_Diffie%E2%80%93Hellman
>  http://en.wikipedia.org/wiki/Perfect_forward_secrecy
>
>  
Very good discussion. This is an important issue.  OpenSSL with Elliptic
Curve was added to the http://rpmfusion.org/Wishlist, but the question
remains open


--
>  users mailing list
>  users(a)lists.fedoraproject.org
>  To unsubscribe or change subscription options:
>  https://admin.fedoraproject.org/mailman/listinfo/users
>  Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
>  Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
>  Have a question? Ask away: http://ask.fedoraproject.org
>
>