{"id":182,"date":"2020-04-16T20:32:00","date_gmt":"2020-04-17T01:32:00","guid":{"rendered":"http:\/\/sycured.127.0.0.1.sslip.io\/?p=182"},"modified":"2024-01-13T17:01:03","modified_gmt":"2024-01-13T22:01:03","slug":"why-not-using-vault-upstream","status":"publish","type":"post","link":"http:\/\/10.42.0.68:8080\/blog\/why-not-using-vault-upstream","title":{"rendered":"Why Not Using Vault Upstream?"},"content":{"rendered":"\n<p>Few people know that I contribute to a few nonprofits and due to laws with hardening (internal security strategy), I needed to verify Vault<\/p>\n\n\n\n<!--more-->\n\n\n\n<h2 class=\"wp-block-heading\">Swim in a nightmare<\/h2>\n\n\n\n<p>It&#8217;s hard but so true\u2026 I never thought to look few things in 2020:<\/p>\n\n\n\n<ul>\n<li>DSA-authorized for SSH<\/li>\n\n\n\n<li>RSA key authorized at 2048 bits<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">SSH with DSA<\/h3>\n\n\n\n<p>Back in 2015, OpenSSH deprecated DSA keys due to weakness:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>Starting with the 7.0 release of OpenSSH, support for ssh-dss keys has been disabled by default at runtime due to their inherent weakness. If you rely on these key types, you will have to take corrective action or risk being locked out.<br>Your best option is to generate new keys using strong algorithms such as rsa or ecdsa or ed25519. RSA keys will give you the greatest portability with other clients\/servers while ed25519 will get you the best security with OpenSSH (but requires recent versions of client &amp; server).<\/p>\n\n\n\n<p>&#8211; https:\/\/github.com\/zmedico\/gentoo-news\/blob\/master\/2015-08-13-openssh-weak-keys\/2015-08-13-openssh-weak-keys.en.txt<\/p>\n<\/blockquote>\n\n\n\n<p>I tried a pull request on GitHub to <a href=\"https:\/\/github.com\/hashicorp\/vault\/pull\/8567\">remove DSA for SSH<\/a> and was refused.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">RSA &lt; 2048<\/h3>\n\n\n\n<p>Back in 2019, RSA was broken using Shor&#8217;s algorithm with quantum computing.<\/p>\n\n\n\n<p>It&#8217;s not a dream:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>Shor\u2019s Algorithm is a three-part answer to the problem of prime factorization for any integer, so it works no matter how large the integer involved. The first part is performed on a classical computer in polynomial time, but it is only the set-up for the second and most important part. The second part requires the use of specially constructed quantum circuits to perform the quantum computation needed to find the value you need for the third part, which allows you to find the prime factors of the integer on a classical computer.<\/p>\n\n\n\n<p>&#8211; https:\/\/www.technologyreview.com\/2019\/05\/30\/65724\/how-a-quantum-computer-could-break-2048-bit-rsa-encryption-in-8-hours\/<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Using it or not?<\/h2>\n\n\n\n<p><em>March 9th, 2020<\/em>, was the day when <a href=\"https:\/\/github.com\/sycured\/vault\">I forked Vault<\/a> and released 3 commits:<\/p>\n\n\n\n<ul>\n<li><a href=\"https:\/\/github.com\/sycured\/vault\/commit\/33e50c9488cbd5c9aa2f04f15b798e2d364d075a\">fix PKI&amp;SSH keys to be at 4096 by default and minimum<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/sycured\/vault\/commit\/18c39a7cb5dc8b55e67814526445e7d3054f208b\">remove duplication error string using variable<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/github.com\/sycured\/vault\/commit\/9e1d7f79b35017ff6e6ed1c4a6eb833249c7ddfe\">remove DSA for SSH<\/a><\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p><strong>Disclosure:<\/strong> I take big decisions inside a nonprofit so it&#8217;s my responsibility like writing an internal security strategy (1st version)<\/p>\n\n\n\n<p>&#8211; <a href=\"https:\/\/sycured.com\">sycured<\/a><\/p>\n<\/blockquote>\n\n\n\n<p>I took time to think about a few things<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Will, I release all my commits?<\/h3>\n\n\n\n<p>I deleted a lot of stuff that we don&#8217;t need like:<\/p>\n\n\n\n<ul>\n<li>Secrets Engines:\n<ul>\n<li>Active Directory<\/li>\n\n\n\n<li>AliCloud<\/li>\n\n\n\n<li>AWS<\/li>\n\n\n\n<li>Azure<\/li>\n\n\n\n<li>ElasticSearch<\/li>\n\n\n\n<li>InfluxDB<\/li>\n\n\n\n<li>Google Cloud with and without KMS<\/li>\n\n\n\n<li>Venafi<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Auth Methods:\n<ul>\n<li>AliCloud<\/li>\n\n\n\n<li>AWS<\/li>\n\n\n\n<li>Azure<\/li>\n\n\n\n<li>Cloud Foundry<\/li>\n\n\n\n<li>Google Cloud<\/li>\n\n\n\n<li>GitHub<\/li>\n\n\n\n<li>Username &amp; Password<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<p>Big breaking change:<\/p>\n\n\n\n<ul>\n<li>DSA deleted<\/li>\n\n\n\n<li>RSA deleted<\/li>\n<\/ul>\n\n\n\n<p><a href=\"https:\/\/en.wikipedia.org\/wiki\/Elliptic-curve_cryptography\">Elliptic Curve<\/a> is the only way\u2026<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Will, I take the risk of using Vault upstream?<\/h3>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>&#8220;Deleting might break things for existing users.&#8221;<\/p>\n\n\n\n<p>&#8211; https:\/\/github.com\/hashicorp\/vault\/pull\/8567#issuecomment-601426028 by <a href=\"https:\/\/github.com\/vishalnayak\">vishalnayak<\/a><\/p>\n<\/blockquote>\n\n\n\n<p>Due to <a href=\"https:\/\/github.com\/hashicorp\/vault\/pull\/8567#issuecomment-601426028\">this reply on my PR<\/a>, I can&#8217;t take the risk.<\/p>\n\n\n\n<p>For them (in my PR, <a href=\"https:\/\/github.com\/vishalnayak\">vishalnayak<\/a>&#8216;s reply is from Vault&#8217;s team), it&#8217;s not a problem to keep weaknesses like DSA alive because they made the mistake and prefer to avoid any breaking change.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\">\n<p>DSA deprecated during August 2015<\/p>\n\n\n\n<p>Vault released during April 2015 (1st release)<\/p>\n<\/blockquote>\n\n\n\n<p>Of course, it&#8217;s difficult to admit their mistake and force users\/clients to migrate to a more secure algorithm like <a href=\"https:\/\/ed25519.cr.yp.to\/\">Ed25519<\/a> before going to <a href=\"http:\/\/pqcrypto.org\/index.html\">post-quantum cryptography<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Will, I take the risk of forking Vault and apply my commits?<\/h3>\n\n\n\n<p>I refuse to provide all my commits under <a href=\"https:\/\/github.com\/hashicorp\/vault\/blob\/master\/LICENSE\">MPL-2.0<\/a><\/p>\n\n\n\n<p>Honestly, it&#8217;s impossible because it&#8217;ll be impossible to follow upstream.<br>I regret but I need to make a decision not just for me, but also for the team.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Our system<\/h2>\n\n\n\n<p>We&#8217;ll build our system inspired by Vault because we can&#8217;t take any risks.<\/p>\n\n\n\n<p>I hope that we can release it under dual licensing.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Laws &amp; Hardening<\/h3>\n\n\n\n<p>We need traceability and a lot of things about who asked to access a secret and more.<br>In addition, we need to harden to be more robust and pass any certification successfully.<\/p>\n\n\n\n<p>At this time, I&#8217;m with Ed25519 way but I continue to read about <a href=\"http:\/\/pqcrypto.org\/index.html\">post-quantum cryptography<\/a> because it&#8217;s tomorrow and we need a more robust system.<\/p>\n\n\n\n<p>One nonprofit is about medical records so we need the most secure system and can&#8217;t accept weakness in the algorithm used.<\/p>\n\n\n\n<p>Keep in touch<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Few people know that I contribute to a few nonprofits and due to laws with hardening (internal security strategy), I needed to verify Vault<\/p>\n","protected":false},"author":1,"featured_media":108,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"saved_in_kubio":false,"footnotes":""},"categories":[13],"tags":[12,19],"_links":{"self":[{"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/posts\/182"}],"collection":[{"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/comments?post=182"}],"version-history":[{"count":1,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/posts\/182\/revisions"}],"predecessor-version":[{"id":183,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/posts\/182\/revisions\/183"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/media\/108"}],"wp:attachment":[{"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/media?parent=182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/categories?post=182"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/10.42.0.68:8080\/wp-json\/wp\/v2\/tags?post=182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}