Would the current set of DSA key blacklists detect a DSA key that was generated with openssl on an affected/vulnerable system, BUT whose DSA parameters (dsaparam) were generated on an unaffected system?

Additionally, would the current weak key detection tools,e.g., ssh-vulnkey or dowkd.pl, miss keys generated this way?


On an unaffected system:

$ openssl dsaparam -out dsap.pem 1024

Copy dsap.pem to an affected system.

On an affected system:

$ openssl gendsa -out dsakeys.pem dsap.pem

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.