Bugzilla – Bug 845686
VUL-0: CVE-2007-6755: Dual_EC_DRBG considered unsafe
Last modified: 2013-10-16 08:57:29 UTC
CVE-2007-6755 The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to cert ain "skeleton key" values, which might allow context-dependent attackers to defeat cryptographic protection mechanisms by leveraging knowledge of those values. NOTE: this is a preliminary CVE for Dual_EC_DRBG; future research may provide additional details about point Q and associated attacks, and could potentially lead to a RECAST or REJECT of this CVE. Reference: MISC: https://www.schneier.com/blog/archives/2007/11/the_strange_sto.html Reference: MISC: http://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect Reference: MISC: http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/ Reference: MISC: http://rump2007.cr.yp.to/15-shumow.pdf Reference: MISC: http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html Reference: MISC: http://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html Reference: MISC: http://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/
need to review our crypto modules, at least - openssl - gnutls (and/or dependend) - mozilla nss
according to this analysis article: http://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html This issue will be an issue only if we are using openssl-FIPS. We have FIPS-140-2 patch for SLES11. The 1st version of Dual_EC_DRBG implementation was pushed into upstream was in 2011: https://github.com/openssl/openssl/commit/7fdcb45745c01b90b256fe97e87eae31453e11e6#diff-f32b6c02a4d65076516461287390f7a9 I think our openssl is safe for now. What do you think? Marcus.
bugbot adjusting priority
openssl - SLE11 SP1 , SP2, SP3 - Dual_EC_DRBG not contained in source gnutls - SLE11 GA and later - Dual_EC_DRBG not contained in source openSUSE 12.2,12.3,13.1,factory - not contained libnettle factory - does not have it gnutls factory - does not have it mozilla-nss 3.15.2 - does not have it. As Shawn wrote, the openssl FIPS additional patch to openssl developed in 2011 did have it, but it was not part of our openssl certification in 2012. -> so we can consider us unaffected.
perl bin/addnote CVE-2007-6755 "We have not the flawed Dual_EC_DRBG random generator in any of our products, neither SUSE Linux Enterprise nor openSUSE."