nCipher Insecure Diffie-Hellman Key Generation Vulnerability
BID:17006
Info
nCipher Insecure Diffie-Hellman Key Generation Vulnerability
| Bugtraq ID: | 17006 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 07 2006 12:00AM |
| Updated: | Mar 10 2006 12:20AM |
| Credit: | The vendor disclosed this issue. |
| Vulnerable: |
nCipher nCipher Software CD 0 nCipher MSCAPI CSP 5.54 nCipher MSCAPI CSP 5.50 nCipher CHIL |
| Not Vulnerable: |
nCipher nCipher Software CD 9.0 |
Discussion
nCipher Insecure Diffie-Hellman Key Generation Vulnerability
Certain nCipher products are susceptible to an insecure Diffie-Hellman (DH) key-generation weakness. This issue is due to the software using random parameters with undesirable properties.
This issue results in the creation of cryptographic keys that may have properties that allow attackers to recover the private key in significantly less time than with brute-force.
By gaining access to private keys, attackers may gain access to potentially sensitive information, perform man-in-the-middle attacks, or bypass security restrictions that depend on the security properties of the compromised DH keys. Other attacks may also be possible.
Certain nCipher products are susceptible to an insecure Diffie-Hellman (DH) key-generation weakness. This issue is due to the software using random parameters with undesirable properties.
This issue results in the creation of cryptographic keys that may have properties that allow attackers to recover the private key in significantly less time than with brute-force.
By gaining access to private keys, attackers may gain access to potentially sensitive information, perform man-in-the-middle attacks, or bypass security restrictions that depend on the security properties of the compromised DH keys. Other attacks may also be possible.
Exploit / POC
nCipher Insecure Diffie-Hellman Key Generation Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution / Fix
nCipher Insecure Diffie-Hellman Key Generation Vulnerability
Solution:
The vendor has released an advisory, along with fixes to address this issue. Please see the referenced advisory for further information.
Solution:
The vendor has released an advisory, along with fixes to address this issue. Please see the referenced advisory for further information.
References
nCipher Insecure Diffie-Hellman Key Generation Vulnerability
References:
References: