31–40 of 49 posts
All. All encryption is breakable. You aren't choosing an unpickable lock, you are picking how good of a thief it will take to rob you. A 4096 bit encryption might make it really expensive to attack you, but those old numbers about "it would take a computer 40,000 years to crack" don't matter much in a world where that just means you spin up 160k instances in the cloud for 3 months. That's a Dollar amount that makes c…
All. All encryption is breakable. You aren't choosing an unpickable lock, you are picking how good of a thief it will take to rob you. A 4096 bit encryption might make it really expensive to attack you, but those old numbers about "it would take a computer 40,000 years to crack" don't matter much in a world where that just means you spin up 160k instances in the cloud for 3 months. That's a Dollar amount that makes c…
To brute-force AES-128, if you assume:
- Every person on the planet owns 10 computers.
- There are 7 billion people on the planet.
- Each of these computers can test 1 billion key combinations per second.
- On average, you can crack the key after testing 50% of the possibilities.
Then the earth's population can crack one key in 77,000,000,000,000,000,000,000,000 years.
Source: Seagate, http://dator8.info/pdf/AES/3.pdf
Earlier quoted context omitted.
For the record DH key sizes are smaller than RSA keys of the same strength based on our current understanding of the computational effort involved in attacking them. DH-256 should be considered on the verge of too small. 340 or 512 will be necessary going forward.
I think I'm probably confusing terms here; you're referring to the size of "a", and I'm referring to the size of "p". Perhaps 'pbsd will be around in a bit to resolve whether the index calculus will push the size of p or a first; my understanding is that it's bounded by the size of the modulus, and that most of the work it does is independent of the specific element of the group you're attacking. I am definitely a lo…
This refers to the size of p, the prime modulus. Sizes of exponents and/or subgroups are not affected by the complexity of the NFS, so they generally only need to be twice the target bit security to avoid birthday-type attacks.
Earlier quoted context omitted.
I think I'm probably confusing terms here; you're referring to the size of "a", and I'm referring to the size of "p". Perhaps 'pbsd will be around in a bit to resolve whether the index calculus will push the size of p or a first; my understanding is that it's bounded by the size of the modulus, and that most of the work it does is independent of the specific element of the group you're attacking. I am definitely a lo…
The NFS complexity for factorization and discrete logarithm is asymptotically the same. In practice, the matrix step is more costly in discrete logarithm, but this should increase the bit security by at most a handful of bits, which is not enough to justify differentiating DL estimates from RSA estimates. This refers to the size of p, the prime modulus. Sizes of exponents and/or subgroups are not affected by the comp…
No ssh2-rsa is not known to be broken, although it's suspected that the NSA can factor some small ( It's believed that any elliptic curve algorithm that doesn't have a transparent process for choosing the curve points may have been backdoored by the NSA choosing points that they already knew how to factor. If you use those curves, then you're revealing your secrets to the NSA but not to anyone else, because the discr…
The word "may" is doing a lot of work in the sentence "may have been backdoored". What cryptographers are observing about the NIST P- curves is that it isn't impossible for them to have been backdoored; that there is a plausible technique that NSA could have used, given some an advance in ECC cryptanalysis unknown to public science but known to them, that could result in a backdoor. Everything beyond that is the prec…
All. All encryption is breakable. You aren't choosing an unpickable lock, you are picking how good of a thief it will take to rob you. A 4096 bit encryption might make it really expensive to attack you, but those old numbers about "it would take a computer 40,000 years to crack" don't matter much in a world where that just means you spin up 160k instances in the cloud for 3 months. That's a Dollar amount that makes c…
Your scale is way off. To brute-force AES-128, if you assume: - Every person on the planet owns 10 computers. - There are 7 billion people on the planet. - Each of these computers can test 1 billion key combinations per second. - On average, you can crack the key after testing 50% of the possibilities. Then the earth's population can crack one key in 77,000,000,000,000,000,000,000,000 years. Source: Seagate, http://d…
http://www.eetimes.com/document.asp?doc_id=1279619
But they are both still wrong.
A. The rate of Keys per second on both are way low, and B, you don't have to test every combination, Certain combinations will tell you that whole chunks of possibilities are not possible.
In truth most of the time you can narrow the potentials to 1% of the total possible to determine a range for the right answer pretty quickly.
Granted if it was as slow as 77 Billion years .7 billion years is still a long time. But no, these numbers are orders of orders of magnitude wrong.
All. All encryption is breakable. You aren't choosing an unpickable lock, you are picking how good of a thief it will take to rob you. A 4096 bit encryption might make it really expensive to attack you, but those old numbers about "it would take a computer 40,000 years to crack" don't matter much in a world where that just means you spin up 160k instances in the cloud for 3 months. That's a Dollar amount that makes c…
160,000 EC2 instances running for years won't make a dent in a 2048 RSA key.
If you don't have one it is billions of times harder. How large is your Prime table? How large is mine? How large is the NSA's?
Ciphers to avoid DSS, MD5/RC4, SHA-1. Ciphers to prefer ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256 A pretty good source/guide: https://hynek.me/articles/hardening-your-web-servers-ssl-cip... You'll need apache 2.4+[I think], or nginx. And possibly fresh certs to use DHE/EC. A quick rundown of a fairly secure setup: Cipher Priority list: ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!ECDH+3DES:DH+3DE…
It should also be mentioned how you came up with your ordering of TLS cipher suites, in declining priority
1. Forward security is preferred (ECDH|DH > RSA)
2. AESGCM > AES256 > AES|AES128 > 3DES
3. ECDH > DHEarlier quoted context omitted.
The word "may" is doing a lot of work in the sentence "may have been backdoored". What cryptographers are observing about the NIST P- curves is that it isn't impossible for them to have been backdoored; that there is a plausible technique that NSA could have used, given some an advance in ECC cryptanalysis unknown to public science but known to them, that could result in a backdoor. Everything beyond that is the prec…
Your glass appears to be half full, mine half empty :)
Earlier quoted context omitted.
160,000 EC2 instances running for years won't make a dent in a 2048 RSA key.
If you have a large enough table of primes and factors RSA 2048 is only about 5% harder to crack than a 1024. If you don't have one it is billions of times harder. How large is your Prime table? How large is mine? How large is the NSA's?