ANSWERED Crypto attack which recovers encryption keys and exposes VPN connections

[iampd 6]

DUHK (Don't Use Hard-coded Keys) is a vulnerability that affects devices using the FIPS compliant ANSI X9.31 Random Number Generator (RNG) in conjunction with a hard-coded seed key.

Are AirVPN connections and/or Eddie vulnerable to this or is this only device specific (Fortinet/FortiOS)?

https://duhkattack.com/

https://www.bleepingcomputer.com/news/security/duhk-crypto-attack-recovers-encryption-keys-exposes-vpn-connections-more/

 

 

[iampd 6]

Any updates from the staff on this topic ?

[freeb1rd 1]

If you are using the OpenVPN protocol, you don't have to worry.

 

https://community.openvpn.net/openvpn/wiki/DUHKattack

 

From the link:

OpenVPN is not affected by DUHK.