1

I need some help for an evaluation in matters of security of the following situation.

The Connection is established with these Certificates:

Client Certificate: 1024 RSA with md5RSA (CA 4096 RSA with md5RSA)
Server Certificate: 4096 RSA with sha256RSA (CA 2048 RSA with sha1RSA)

Allowed Cipher Suites are:

  • TLS_RSA_WITH_AES_256_CBC_SHA (0x35)
  • TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)

I state that the Client Certificate needs to be upgraded to improve the size for security. I recommended 4096 RSA to be future-proof for the next few years.

The respond I got state that there is no security risk with this constellation, because of the strong client CA cert and the strong server certificate.
And that the 1024 RSA certificate is only used for authentication, not for encryption.

Are these valid arguments? Any why?

Improve this question

1 Answer 1

Reset to default
4

The main problem is less the 1024 bit RSA but the md5 signature used for the certificate. MD5 is known since lots of years to be heavily insecure and was actively used to clone certificates. But, if it is possible to clone the client certificate then it can no longer be used to securely authenticate the client.

Apart from that, "only used for authentication" is the wrong approach. If authentication is irrelevant then just skip it. But if it is important to properly authenticate the client then it should be done properly.

Improve this answer
7
  • thx, but what if we focus on the RSA keylength and the argument regarding the 'no security risk'?
    – hdev
    Oct 4, 2016 at 13:26
  • @dh_cgn "Cracking" a 1024-bit RSA key pair is still prohibitively expensive these days. It is much easier to find a collision on an md5 hash to create a fake certificate.
    – billc.cn
    Oct 4, 2016 at 14:08
  • @dh_cgn: 1024 bit is kind of ok for RSA today. But the real strength of the RSA key does not matter at all since the attacker can simply create its own certificate (even with a 2048 bit key) which has the same MD5 signature as the original certificate. The strength would only matter if the server would also check the public key of the client certificate (i.e. pinning) since the key pair itself cannot be reproduced by the attacker.
    – Steffen Ullrich
    Oct 4, 2016 at 14:16
  • I understand the issue with md5. So you would say there is not a real security decrease, regarding the use of Client 1024 and Server 4096? keylength.com recommends the minimum of 2048 bits.
    – hdev
    Oct 4, 2016 at 15:05
  • 2
    @JOW: I don't understand what "only" used for authentication means. If authentication is not important then why do it? If authentication is important do it properly. Apart from that RSA 1024 and SHA-1 are probably sufficient today unless you have an attacker with lots of money (i.e. states). But there is a reason 2048 and SHA-2 is the recommended way and one should better move to it in in the near future.
    – Steffen Ullrich
    Oct 4, 2016 at 16:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .