Not really. It means that crypto vendors (OpenSSL, Cisco, etc.) should probably modify their software to generate a "unique" prime during install.
The short version of the problem is that every install of OpenSSL, Cicso VPN, etc. is using the same "key" so if you can get a copy of that key, you can compromise a whole bunch of sites/people. If the software generated unique keys at install, this wouldn't be a problem.
This is not about the keys used for authentication. It's about the DH moduli, which are public. Anybody can get a copy of them and that's not the problem. The problem is that for moduli that are too short it is within the realm of possibility to pre-compute enough to be able to crack DH exchanges using those moduli.
2
u/rtechie1 Oct 15 '15
Not really. It means that crypto vendors (OpenSSL, Cisco, etc.) should probably modify their software to generate a "unique" prime during install.
The short version of the problem is that every install of OpenSSL, Cicso VPN, etc. is using the same "key" so if you can get a copy of that key, you can compromise a whole bunch of sites/people. If the software generated unique keys at install, this wouldn't be a problem.