On Wed, Feb 11, 2004 at 09:16:40AM +1100, Tim Eddy wrote: > Marc, > > If we remove the default exemptions for Kerberos & RSVP from IPSEC with > the "NoDefaultExempt" registry key, this still passes IKE. Therefore is > IKE vulnerable to the ASN bug? It would appear that it is indeed. The Internet Key Exchange protocol is defined in RFC 2409, and section 5.2, "Phase 1 Authentication With Public Key Encryption", states that "RSA encryption MUST be encoded in PKCS #1 format". The PKCS #1 standard always uses ASN.1 to encode the keys and signature schemes used. G'luck, Peter -- Peter Pentchev roam@xxxxxxxxxxx roam@xxxxxxxx roam@xxxxxxxxxxx PGP key: http://people.FreeBSD.org/~roam/roam.key.asc Key fingerprint FDBA FD79 C26F 3C51 C95E DF9E ED18 B68D 1619 4553 If this sentence didn't exist, somebody would have invented it.
Attachment:
pgpBs2zd5dazu.pgp
Description: PGP signature