Tomorrow is Microsoft’s “Patch Tuesday” for this month. As I noted in the preview post, there are only two patches scheduled for release, neither of which is for Windows itself. Many home users, especially, will have no patches to apply.
Dr. Johannes Ullrich, of the SANS Technology Institute, has a diary post at the SANS Internet Storm Center that suggests one reason that the patch load is especially light this month.
In part, the low number of bulletins appears to be intentional, to not distract from the more complex issue which will affect Windows users starting with the October update set: Windows will no longer allow SSL certificates with RSA keys that are less then 1024 bits in length.
These certificates are cryptographic credentials used to secure Internet connections via the SSL/TLS protocols, which create an encrypted connection between the user’s browser and the server. The connection protocol also provides the user with some assurance that she is actually connecting to her bank’s Web site, and not to some Bad Guy’s imitation. The certificates can also be used for encrypted E-mail. I’ve written here before about some of the problems associated with these certificates and the Certificate Authorities [CAs] that issue them.
Microsoft’s intention is to disallow certificates that have a key length less than 1024 bits, on the grounds that they are insecure, which is certainly true. Further details are given in Microsoft’s Security Advisory (2661254). The change, which will be pushed as a patch as part of October’s “Patch Tuesday”, will affect all supported versions of Windows and its components. (It will not affect Windows 8 Release Preview or Windows Server 2012 Release Candidate, because those versions already include this change.)
The potential problem for users is that some may have specialized or internally-developed applications that use certificates with short keys. These will cease to work once the October update is installed. Microsoft has a Knowledge Base article explaining the implications of the change; it also contains download links for the patch, which is available now for testing. As Dr. Ullrich says, you really should test this while you have the opportunity.
As a first step, you should install the patch on a test system, and watch for any problems. You should also carefully inventory your certificates, in particular if you are using non-standard (internal) certificate authorities.
He goes on to say that you should, if possible, avoid creating new 1024-bit RSA keys, but use 2048- or 4096-bit keys instead. This is also excellent advice.
Posted by Rich 
Random Walks 