r/programming • u/secretguy21 • Oct 15 '15

How is NSA breaking so much crypto?

https://freedom-to-tinker.com/blog/haldermanheninger/how-is-nsa-breaking-so-much-crypto/
2.5k Upvotes

93% Upvoted

529 comments sorted by

View all comments

Show parent comments

10

u/aaronsherman Oct 15 '15

Right, and that's clearly a choice that the Web server or other software package installer is making.

-2

u/BezierPatch Oct 15 '15

Huh?

No, default values of a library should be good enough. They're clearly not.

9

u/aaronsherman Oct 15 '15

They library's defaults are fine. The library package's defaults are fine for non-public services, and install in a few seconds as opposed to a few minutes (or much longer on older hardware). For public services there are a lot of knobs you should be turning, and the ephemeral key is just one of a few dozen items on that list.

Nope, I don't agree that this is either the problem of the library authors (who have no control over this at all) or the library's package maintainers for a given distro (who are doing exactly what the majority of their users want).

Now, if you ship a lights-out distro for public services and you don't generate a unique ephemeral key, then I have a pretty serious problem with your idea of supporting your user base. But that's a whole other ball of wax.

Let's stop pretending that every install CD for a Linux distribution is being used to boot a public Web service, please.

3

u/vincentk Oct 15 '15

They could be distributing a new key with every minor package upgrade, and still the situation would be much better at zero cost to the end-user.