Slashdot Mirror
Microsoft: As of October, 1024-Bit Certs Are the New Minimum
way2trivial writes with this snippet from Information Week about a warning from Microsoft reminding Windows administrators that an update scheduled for October 9th will require a higher standard for digital certificates. "That warning comes as Microsoft prepares to release an automatic security update for Windows on Oct. 9, 2012, that will make longer key lengths mandatory for all digital certificates that touch Windows systems. ... Internet Explorer won't be able to access any website secured using an RSA digital certificate with a key length of less than 1,024 bits. ActiveX controls might be blocked, users might not be able to install applications, and Outlook 2010 won't be able to encrypt or digitally sign emails, or communicate with an Exchange server for SSL/TLS communications."
TechRepublic noted this a while ago and provided detailed instructions on how to work-around the issue.
"Maybe this world is another planet's hell"
Aldous Huxley
No matter how few people actually read through the Linux kernel code, it's sufficiently open that blatant backdoors are not going to be inserted.
Open source suffers from quasi-religious stuff too, as you just demonstrated with your claim. Ken Thompson, of Bell Labs and Unix and C fame - the "K" in K&R, demonstrates the insufficiency of being able to read the source code.
http://cm.bell-labs.com/who/ken/trust.html
Nice weasel word there. Blatant. What makes you think that if there are backdoors in Windows they're blatent?
Think back to the AARD code, they went way out of their way to obfuscate it. Microsoft would not be so stupid as to put a well commented backdoor in there.
Of course, I'm sure someone will bring up the NSAKEY incident, which various security researches (such as Bruce Schneier) have dismissed as merely allowing the NSA to install their own key to be install for their internal systems without having to have MS sign it.
You do know that backdoors have been inserted into Linux distro's in the past, and some of them took a great deal of time to be discovered. Then of course, one never really knows if a security vulnerability is intentional or not (on any platform).
There have also been some near calls as well in the kernel itself. For instance, who remembers this doozy?
http://www.securityfocus.com/news/7388
Yes, it was caught, but not because of "many eyes". It was because the attacker chose to try to modify the version control file directly. Had it gone in by some other means, it may not have been caught at all.
If you need web hosting, you could do worse than here
The website was hacked. The Linux source was not compromised.
1024 was selected because this will not affect any US corporations, who always used 1024 bit certificates. Lower bit lengths were only ever offered because US export law would not allow high strength encryption products to be exported from the US, so MS and others shipped a lot of crippled copies of Windows NT, 95, 98 and maybe even Windows 2000 to customers outside the US.
smart/feature phones
There's your biggest drawback to the 1k keysize. How many of them can handle more then that? Simply put, it's the U.S. Telco's that aren't able to handle anything larger as everyone else offers phones that can handle 2k+ certs.
Mod me up/Mod me down: I wont frown as I've no crown
I don't know about you, but I went to school. I see a factor of 10 between 1 and 10.
Have a look at http://en.wikipedia.org/wiki/Birthday_problem A group of just 23 people is required to get a 50% probability two people will have the same birthday, despite there being 366 different days in the year. 57 for 99% probability. That equates to 6.3% change, hits 50% probability and 15.5% hits 99%.
If moving to 2048bits makes 15% of the certs in use invalid, the vast majority of your users will be effected.