OpenSSL

So basically on Windows, it's to use the new S-channel stack.

And in the case of Linux, you use OpenSSL 3.5, which has MLChem built into it.

So you've got those two options are now available to you.

So that's the data in transit taken care of.

Those have very standard libraries for handling SSH and handling SSH authentication, and this sounds like they rolled their own crypto or at least their own authentication library to introduce this issue.

'Cause I'm not aware of any, like, open SSH or OpenSSL or, like, any AuthD issues that could have caused this.

So it's interesting, um, seeing this pop up in a router that, in my opin- I mean, without knowing the specifics, but more often than not, they use standard libraries.

So that was interesting.

Like that's an unfair characterization of the nature of this problem.

Bugs like this have affected OpenSSL, which is something that like You're using right now, you and I, to record this video somewhere behind the scenes.

We're using that piece of open source software to encrypt our communication over the internet.

That had a zero day several years ago that was related to bad RNG that caused sessions to be able to be decryptable.

You don't need an agent to do that.

You could run an agent if you want to go really deep on pen testing like OpenSSL, for example.

But just to check whether a TLS cipher, a weak TLS cipher is in use, you can use testssl.sh, just a tool that you can run and you'll be able to get the output.

So using a combination of both the agent and then those deterministic tools as well gives you a pretty decent coverage of standard methodologies.

The main tool chain moves to BenUtils 2.47, GCC 16.2, and glibc 2.44.

The book now uses Linux kernel 7.1.8, along with Python 3.14.7, Systemd 2.61.2, OpenSSL 4.0.1, core utils 9.11, and a bunch of other updated components.

In total, 46 packages were updated and added since LFS 13.0, and the team says more than 200 commits went into the book between releases.

There are also some security-related updates, but the reason I want to tell you about this is because I like covering Linux from scratch.

And we're on the verge of trying to select an automated system.

But in the interim, I spend a lot of time with OpenSSL, popping out CSRs and, you know, matching them into PFXs and all the things.

So you can do everything you need to with OpenSSL tool with a certificate.

So I do a lot of that.

Then, because this is, most of it involves securing sites, Then I use Qualys SSL Labs, which is a free website you go to.

which is nice for on-premises stuff because there's things that are behind, you know, internal sites behind a firewall, is TestSSL, which you can get on GitHub.

And then you pull that down, it runs a little shell script.

And again, this is kind of like OpenSSL in that it runs best in Linux.

Then above that, you've got, um, say TLS one dot three with hybrid, right? Is you open those floodgates 'cause now people can use that stack.

So basically on Windows, it's to use the new S Channel stack, and in the case of Linux, you use OpenSSL three point five, um, which has ML-KEM built into it.

So you've got those two options are now available to you.

Um, so that's, that's the data in transit taken care of.