<div dir="ltr"><div><div><div><div>I'm also no crypto expert, but I think the FS community needs to be more concerned with security these days, given what we now know.<br>I agree that using EC may not be the smartest thing to do, and I have also been following the ongoing discussion.<br>
<br></div>The problem is that we really don't know exactly which forms of EC present in latest openssl have been cooked, if any at all besides the one we already know about.<br></div>Right now there's just too much speculation and little fact. I've taken notice of Schneier's concerns, but he offers little more than a gut feeling at the moment to distrust EC in general. I can obviously understand distrusting some specific EC implementations where we now know some agency-which-we'll-not-name-here has cooked the constants (<a href="http://www.scmagazine.com.au/News/356751,leaked-nsa-docs-suggest-dualecdrbg-backdoor.aspx">Dual_EC_DRBG</a>), but that's a far cry from disabling all EC completely.<br>
<br></div>Regardless of what we eventually discover, it seems to me that updating TLS to 1.2 in FS is smart security. At least then we have the option of disabling certain ciphers and EC implementations, but we're in control. Right now I don't know how to disable certain ciphers in FS and force the use of others to enforce PFS for example. Perhaps I'm just ignorant, but I can't find that documented anywhere<br>
As it stands right now, FS is limited to TLS 1.0 and AES 128 bit (correct me if I'm wrong), which is known to be vulnerable to a few attacks, even if BEAST and the like are highly unlikely attack vectors in a FS session.<br>
<br></div>I do hope that FS developers take notice. It's great to have WebRTC and all the other cool and new protocols being rolled into FS, but for many people security is becoming of paramount importance. As a long time user and fan of FS, I do hope that security becomes just as much a priority.<br>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Sep 13, 2013 at 1:17 PM, Patrick Lists <span dir="ltr"><<a href="mailto:freeswitch-list@puzzled.xs4all.nl" target="_blank">freeswitch-list@puzzled.xs4all.nl</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 09/13/2013 01:29 PM, Mehroz Ashraf wrote:<br>
> Agreed ! TLS/SSL seems to be not so important unless FS is capable of providing security implementation in some form atleast. This is great, when you JUST have to secure your communication.<br>
><br>
> but, NOT , when security is the only concern. I have been trying to mature the TLS handshake on SUITE-B standard, but yet unsuccessful acquiring so.<br>
><br>
> I believe that FS use openSSL for dealing with encryption methods and therefore, I have taken it to the version 1.0.1e, which supports TLS1.1 , 1.2 . But , FS doesnt verfiy those Cipher [TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256].<br>
><br>
><br>
> I have already a jira ticket opened here:<br>
><br>
> <a href="http://jira.freeswitch.org/browse/FS-5719" target="_blank">http://jira.freeswitch.org/browse/FS-5719</a><br>
<br>
</div>I'm no crypto expert but given that the NSA seems to have cooked the EC<br>
constants and that Bruce Schneier has publicly stated that he no longer<br>
trusts EC, using EC for supposedly increased security may not be the<br>
smartest thing to do. Also keep in mind that at least RHEL5/CentOS5 &<br>
RHEL6/CentOS6 have EC disabled in openssl. I'm not sure about Debian<br>
(comments welcome).<br>
<br>
The only thing that seems to keep security afloat is using lots of bits<br>
when generating keys and common sense like don't use RC4, export<br>
ciphers, etc.<br>
<br>
Regards,<br>
Patrick<br>
<div class="HOEnZb"><div class="h5"><br>
_________________________________________________________________________<br>
Professional FreeSWITCH Consulting Services:<br>
<a href="mailto:consulting@freeswitch.org">consulting@freeswitch.org</a><br>
<a href="http://www.freeswitchsolutions.com" target="_blank">http://www.freeswitchsolutions.com</a><br>
<br>
FreeSWITCH-powered IP PBX: The CudaTel Communication Server<br>
<a href="http://www.cudatel.com" target="_blank">http://www.cudatel.com</a><br>
<br>
Official FreeSWITCH Sites<br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
<a href="http://wiki.freeswitch.org" target="_blank">http://wiki.freeswitch.org</a><br>
<a href="http://www.cluecon.com" target="_blank">http://www.cluecon.com</a><br>
<br>
FreeSWITCH-users mailing list<br>
<a href="mailto:FreeSWITCH-users@lists.freeswitch.org">FreeSWITCH-users@lists.freeswitch.org</a><br>
<a href="http://lists.freeswitch.org/mailman/listinfo/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/listinfo/freeswitch-users</a><br>
UNSUBSCRIBE:<a href="http://lists.freeswitch.org/mailman/options/freeswitch-users" target="_blank">http://lists.freeswitch.org/mailman/options/freeswitch-users</a><br>
<a href="http://www.freeswitch.org" target="_blank">http://www.freeswitch.org</a><br>
</div></div></blockquote></div><br></div>