Google plans to beef up its SSL encryption keys - curtisyouper

Google plans to rise the protection of its SSL (Guarantee Sockets Layer) certificates, an important factor of secure communication theory.

SSL certificates are misused to write in code communication and verify the unity of other party with which a user is interacting. Its strength lies in the length of the privy signing keys used for the certificates.

Keys that are less than 1,024 bits are reasoned weak, and 512- and 768-bit keys have been factored to break a snobby key. Google has been using 1,024-spot keys, but will move to 2,048-bit keys, wrote Stephen McHenry, Google's theatre director of information security engineering, in a web log post Thursday.

"We will get switch to the new 2048-bit certificates on Lordly 1st, to ensure adequate time for a close rollout before the end of the year," atomic number 2 wrote. "We're likewise going to modification the root certificate that signs all of our SSL certificates because it has a 1024-bit key."

McHenry warned that most client software package won't have trouble with the alteration, but client software program integrated in some phones, printers, set-top boxes, gaming consoles and cameras could have problems.

He wrote that devices making SSL connections with Google will take to support normal establishment of the certificate chain, asseverate an large set of root certificates and support Theme Alternative Name calling (SANs), which allows matchless SSL certificate to corroborate several hosts.

Google's move is prudent, just SSL still has other weak points.

Hundreds of organizations around the world can issue SSL certificates that are tied back to a sol-called Certificate Authority. These organizations, known as intermediates, have been targeted by hackers. Creating a fallacious certificate SSL certificate bottom make information technology come out a soul is visiting a legalise website when in fact it is fraudulent.

Google was the dupe of such an attack in 2011 after a Certificate Authority called DigiNotar was breached. Hackers generated at least 500 fraudulent SSL certificates, including uncomparable that was used in attempted man-in-the-middle attacks against Gmail users in Iran.

In 2009, security research worker Moxie Marlinspike created a tool called SSLstrip, which allows an attacker to intercept and stop a SSL connective, although in that respect is a fix that will block such an attack. Attackers using the tool can spy on whatever data is sent to a fake website.

Source: https://www.pcworld.com/article/452050/google-to-lengthen-ssl-encryption-keys-from-august.html

Posted by: curtisyouper.blogspot.com

Share this post