CAcert NEWS Blog

CAcert/GnuPG/Thawte WOT Event in Erlangen, Germany on 26th of June

morty — Thu, 19 Jun 2008 11:00:21 +0000

The will be a WOT event on 26th of June (Wednesday evening at 19h to 20h local time) at the Techfak in Erlangen, Germany. We are still looking for CAcert assureres. More Information can be found at the planning Wiki. There will also be the Techfak Sommerfest at the same location, so nobody will go hungry.

Bandwidth saved by RSScache.com

Assurers at Festival Of Roses 2008

Maurice — Mon, 16 Jun 2008 12:42:36 +0000

On august 8, 9, 10 and 11 the Festival Of Roses (Rozenfestival) is held in Lottum, the Netherlands.
If you plan to visit and you’re looking for assurers, Maurice and Joost will be at the festival itself (and several more in the vicinity).

There will be no official CAcert stand and no official CAcert presence. plese make arrangements with us in advance, otherwise finding us can be hard.

Bandwidth saved by RSScache.com

CAcert Assurance and OpenPGP Keysigning at Metro Olografix Camp (Pescara, Italy) August 21-24

Fabrizio Tarizzo — Mon, 16 Jun 2008 14:46:30 +0000

The second edition of the Metro Olografix Camp (MOCA) will take place August 21st to 24th 2008, at the “ex Caserma Di Cocco” Park in Pescara, Italy (look at the map). MOCA is a hacker camp in north-European style, free admittance, open to all, to meet and have fun sharing information and knowledge.

Italian CAcert assurers will be available for information and individual assurances during the four camp days.

A Keysigning party is also planned, you can register on Biglumber.

Bandwidth saved by RSScache.com

[Ad] Do you Have Over $15k In Debt?

Cut your payments by 60%! Be Debt Free in just 12 months.

CAcert.org at OpenExpo08 in Zürich/Winterthur - September 24./25., 2008

hugi — Tue, 10 Jun 2008 13:01:47 +0000

OpenExpo, the Swiss conference and trade show for Free and Open Source Software, takes place for the 5th time Wednesday and Thursday September 24 and 25, 2008 at the Eulachhallen in Zürich/Winterthur. Read more… http://www.openexpo.ch/en/openexpo-2008-zurich

Additional Swiss assurers or assurers from any country with successfully passed assurer test and willing to help, register in the CAcert.org Wiki: http://wiki.cacert.org/wiki/OpenExpoCH2008-Z%C3%BCrich/Winterthur

———————————————————————————————————————————————–

OpenExpo, die Schweizer Messe und Tagung für Freie und Open Source Software findet in fünfter Austragung am Mittwoch und Donnerstag, 24./25. September 2008 in den Eulachhallen Zürich/Winterthur statt. Mehr unter… http://www.openexpo.ch/openexpo-2008-zuerich

Zusätzliche Schweizer Assurer oder Assurer aus irgend einem Land mit erfolgreich absolviertem Assurer Test, welche mithelfen wollen, tragen sich bitte im CAcert.org Wiki ein: http://wiki.cacert.org/wiki/OpenExpoCH2008-Z%C3%BCrich/Winterthur

Bandwidth saved by RSScache.com

Audit Report 20080602

iang — Sat, 07 Jun 2008 14:19:11 +0000

The June Audit report to the Community, the latest in a series of two-monthly reports, is now on the wiki. Here are some highlights.

The biggest issue facing CAcert is the state of the systems and the systems administration team. The Audit requirement is for the systems to be under a secure regime that is suitable for a certificate authority: dual control, extra eyes over the critical systems, and reasonable physical security. These things have not been done for the critical systems, and only partly done for the non-critical systems such as email, wiki.

The recent plan to have Evaldo lead the process has been dropped (not in my opinion due to any failing on his part). Now the board of CAcert has to work up a new plan to make this happen somehow.

The move of the critical systems and the rebuilding of systems administration into a team has taken on the aspect of a never-ending Nordic saga, which is no good sign. I will give it until the end of the year to see if CAcert can build the team, and put the systems into shape. If not, we as a Community will have to re-examine how we are going to move forward without systems that are adequate to the certificate authority mission.

Other highlights:

The CAcert Community Agreement is in place as policy, now, but the roll-out of other important issues such as CAP form (here), agreement on the website, and emailed notifications of change are all lacking. Lack of developers is an issue, and is probably the same story as with the systems administrators team.
Arbitration is working out well, and we are now in the “teething stage” of working through the little and unexpected problems.
The Assurance Policy work-in-progress is now in a call to go to DRAFT, which will make it binding on the community. This important document lays the framework for Assurance, leaving most of the details for the Handbook. There are a couple of fairly minor changes that Assurers will need to be aware of:
- Assurance points now only cover Assurance on your details, and there is now (to be) a new count for Experience Points. Assurance Points will therefore always indicate only of how others have assured you, and Experience points will indicate how many Assurances you have done.
- Mutual Assurance is now a standard option, and the CAP form will be upgraded to show that. In effect, a non-Assurer can now assure an Assurer, but, this assurance happens under the supervision and responsibility of the Assurer. For this, a non-Assurer can allocate 0,1,2 points according to her judgement, and you should teach her to be skeptical!
As soon as we can make it, the older Assurers who have not done the Assurer Challenge will be blocked from more Assurances.

The Audit is a long way behind schedule. As above, the systems are completely stalled. The policy work is also slow, and although not a blocking action, it should be stressed: we need these policies in place, not perfect, but usable. Seek for consensus, and be prepared to lose some battles. By the end of the year, we should have the Assurance process on a good strong basis.

Bandwidth saved by RSScache.com

CAcert/GnuPG/Thawte Certification & Keysigning in Budapest - Hungary on 27th of June

yang — Thu, 29 May 2008 11:29:27 +0000

Certification & Keysigning will be held on 27th of June (Friday evening at 18h local time) in SUN Microsystem’s office at Kapas utca 11-15, Moszkva Tér, 1027 Budapest - Hungary. You can submit your attendance and your keys latest by 15th of June (Sunday), the listing will be made on Monday. The official site about the meeting is held on CAcert wiki. The official IRC channel for this meeting is on irc.freenode.net #cacert.hu

Bandwidth saved by RSScache.com

Recent Debian private key generation vulnerability

teus — Fri, 23 May 2008 13:50:27 +0000

Recently discovered predictable RSA and DSA key generation vulnerabilities occurring in Debian OpenSSL packages[1][2]. As many Linux distributions are based of Debian derived distributions like the popular Ubuntu, Knoppix, Kubuntu distributions, there are a significant number of vulnerable RSA and DSA private keys around now.

SSH keys generated on Debian distros have these vulnerabilities too. This will affect SSH system administrators and users. These users should refer to available advice[3]. The rest of this advisory will focus on key and X509 certificate implications.

Description:

Users and system administrators generate RSA and DSA keys for a large number of applications[4]. Those who have OpenSSL, or any of the many applications that use OpenSSL libraries, on vulnerable platforms are affected. Those systems that allow remote access as a result of a user provided vulnerable public key may also be at risk of unauthorized access.

How is CAcert affected?

Luckly, the CAcert Root Class 1 and 3 keys are not affected as these were generated before the vulnerability was introduced into Debian[3] in September 2006. The process that signs CSR (certificate signing requests) and therefore all signed public keys does not use any key generation, so they are not affected by CAcert. Conclusion: CAcert does NOT have to reissue every signed certificate.

But if you have generated a new certificate later as August 2006 and used OpenSSL on a Debian system please read on. First is explained what actions have been undertaken by CAcert in order to recover from this vulnerability event. If you used Debian this may help you as well.

CAcert is using Debian OS and so CAcert’s internal systems were affected, as they generated predictable RSA and DSA keys for internal use, eg ssh authorized_keys for remote system administration. As SSH access is restricted to only to a few static configered IP addresses this posed only a very low risk.

The server certificates of servers like https://www.cacert.org and https://secure.cacert.org were affected by a poor key. CAcert has replaced those keys.

How can servers and clients be affected and what should you do now?

Please refer to our Debian Vulnerability Handling wiki page.

Daniel Black, system administrator for CAcert

[1] http://www.debian.org/security/2008/dsa-1571 Debian Security Advisory
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0166
[3] http://www.debian.org/security/key-rollover/
[4] http://wiki.cacert.org/wiki/DebianVulnerabilityHandling

Bandwidth saved by RSScache.com

Recent Debian private key generation fulnerability

teus — Fri, 23 May 2008 13:50:27 +0000

Recently discovered predictable RSA and DSA key generation vulnerabilities occuring in Debian OpenSSL packages[1][2]. As many Linux distributions are based of Debian derived distributions like the popular Ubuntu, Knoppix, Kubuntu distributions, there are a significant number of vulnerable RSA and DSA private keys around now.

Description:

Users and system administrators generate RSA and DSA keys for a large number of applications[4]. Those who have openssl, or any of the many applications that use openssl libraries, on vulnerable platforms are affected. Those systems that allow remote access as a result of a user provided vulnerable public key may also be at risk of unauthorized access.

How is CAcert affected?

The server certificates of servers like https://www.cacert.org and https://secure.cacert.org were affected by a poor key. CAcert has replaced those keys.

How can servers and clients be affected and what should you do now?

Please refer to our Debian Vulenrability Handling wiki page.

Daniel Black, system administrator for CAcert

Bandwidth saved by RSScache.com

Date of Birth information handling by CAcert

teus — Fri, 23 May 2008 10:12:23 +0000

Date of Birth information is needed for operational purposes and could not be dropped.

CAcert takes strong measures to maintain and guard your private information. Currently CAcert uses for individuals the full formal name, date of birth (DoB) and email/domain address(es). The DoB is used for discrimination of similar names of individuals.

A long debate on the CAcert policy email list (email:cacert-policy@cacert.org) discussed the issue if date of birth could be dropped from the archive. Alternatives for purpose of name discrimination were explored and debated upon. But it did not result in an accepted and efficient alternative.

CAcert made the decision to comply fully with the European privacy directive (EU DPA). The DoB information is however felt to be archived and needed for operational measurements at Assurance time (Web-of-Trust) and later. Alternatives, which are hopefully better in the name resolution, will continue to be investigated and solutions are challenged for.

It is noticed that the date of birth information is commonly used in the internet environment (and even more private information is made available) and that this data is poorly managed. Even some (European) governments are providing this information openly in some instances. The data of birth (and even email addresses) are only available to CAcert Assurers and only in times of assurance requests and arbitration cases if needed so. There are binding policies for the Assurers for doing so, subjected to arbitration.

Bandwidth saved by RSScache.com

Archived copies of Identity Documents should be destroyed within CAcert.

teus — Fri, 23 May 2008 10:11:26 +0000

CAcert will destroy archived copies of ID’s and asks their Assurers to do so as well.

When CAcert started in 2002 it was required that copies of ID’s were archived for 7-10 years in the archives of CAcert or archives of CAcert Assurers. In a later instance CAcert required to take note of ID numbers and/or social security numbers of the individual instead of the copy of the ID. In 2006 for privacy reasons this data (copy of ID, personal numbers) was dropped. The CAcert Assurance Programme (CAP) form states however that the information should be kept 7-10 years.

As CAcert Inc. dropped the requirements for copies of ID and personal numbers the CAcert Inc. association by order of the Committee (Board) decided to remove this information from the CAcert archives and require that the CAcert Assurers who are in possession of that information to do the same: destroy archived copies of ID’s and delete social security numbers from the CAP forms. The information should be deleted with care as stated in the CAP agreement.

Bandwidth saved by RSScache.com