2

I know of a site that is currently using SSLv2 and I'm refusing to connect to them until they

  1. Disable SSLv2
  2. Re-key their servers

I'm insisting on #2 because due to DROWN, servers running SSLv2 should consider their private keys compromised. A re-key is the only thing that will solve that issue.

Is there a way for me to prove that the site has re-keyed their server? I can check the certificate (which will need to change), but how do I know they didn't just re-use the same key and get a new certificate?

I know I can use openssl x509 -pubkey to get information about the public key (which is tied directly to the private key) from the certificate. If the public key changes, does that mean that private key has changed?

Or, a better question might be "if the public key changes, is it at all possible that the private key has not changed"? I would compare the public key's modulus and exponent, of course, not just the bytes of the DER-encoded files I was able to fetch or derive.

Will public-key comparison work, and is there a better way?

  • You could tell them to use an ECDSA cert/key; you can be certain that wasn't DROWNed even if it is old. But it could have been e.g. published on Facebook and Twitter. Plus using ECDSA effectively forces ECDHE -- and thus PFS, unless they store the supposedly ephemeral keys. – dave_thompson_085 Apr 13 '16 at 0:35
  • After a little more digging, I found that DROWN doesn't (at least not directly) allow disclosure of the private key: DROWN only compromises a single connection at a time. So, technically, re-keying the server(s) is not necessary. – Christopher Schultz Apr 14 '16 at 14:31
2

Short answer: If the public key has changed, so has their private key.

Long explination: Modern cipher suites used by SSL/TLS servers have exactly one key pairing. So as long as one of the keys has changed, then the other key has changed as well. So if they have also disabled SSLv2 then you should be good to go. More information can easily be found on the Crypto stack.

1

Theoretically, the DER-encoded public key may be changed without modifying the actual secret in the private key; there are (at least) two ways to do that:

  1. Change the DER encoding. While DER is supposedly deterministic, there is still an optional element in the AlgorithmIdentifier structure that identifies the key type. For a RSA public key, the OID in that structure should point at RSA, and the "parameters" should traditionally be set to an ASN.1 "NULL" value, but the parameters may also be omitted altogether, which should still work in most places, but will change the DER encoding.

  2. The public exponent may be changed while keeping the same modulus, i.e. the same factors, which more-or-less implies using the same private key (that is, the factors will remain the same, even if the private exponent is modified).

However, such tricks would be a lot of effort with no plausible motive. Thus, in practice, you can assume that if the public key changed, then a new private key was generated.

(Mind, though, as @Nathan points out, that a new generated key does not imply that the new key was generated or stored properly; in fact, it could be argued that the management of a site that still supports SSLv2 in early 2016 is quite sloppy with regards to security in general.)

  • I'll never be able to prove or disprove competent key security, unfortunately. – Christopher Schultz Apr 12 '16 at 20:23
  • 1
    As for the DER encoding, I would never just run diff on the two files. Instead, I'd unpack the modulus and compare that byte-for-byte. That would ignore any funny business that the public key had undergone that doesn't change anything about the actual crypto. – Christopher Schultz Apr 12 '16 at 20:23
0

If the public key changes, does that mean that private key has changed?

Yes.

Worth noting that it's probably pointless insisting on such a change (the rekey) - for all you know, their new key pair is stored on a shared folder open to the whole office... That is to say, regardless of how new it is, the key is only as good as their operational security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.