Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Protect Yourself from NSA Attacks on 1024-bit DH

eff.org

Post reply on HN
Print view View original

31–40 of 140 posts

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#31

Post by PlzSnow »

olympus wrote: post #24

This recent publication illustrates a problem that we have trying to keep our communications secure. If we all use a single "strong" prime number with our crypto then the NSA has a huge incentive to pre-compute results from that single strong number. Now that we know that the NSA is doing this, we won't all use a proven strong number, and we will all start to do key exchanges with another method, and it will become t…

"If we all use a single "strong" prime number with our crypto then the NSA has a huge incentive to pre-compute results from that single strong number. Now that we know that the NSA is doing this"

We don't know the NSA is doing this. There's no evidence whatsoever beyond conspiracy theory stuff.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#32

Post by tptacek »

olympus wrote: post #29
tptacek wrote: post #27

Earlier quoted context omitted.

Not really. This precomputation attack only works because attacks on 1024 bit discrete logs were already plausible. We don't choose cryptographic parameters to make the NSA's job harder ; we choose them to make the job implausible . So it's exactly the wrong message to take from this paper that we should mix up parameters more; rather, the message is: don't use weak moduli.

> don't use weak moduli. By this do you mean don't use 1024 bit keys? Would using 2048 bit (or larger) mean that the NSA wouldn't be able to buy a computer that could do the computation within a year? Why don't we all use 2048 bit keys then? Is the communication and processing overhead so high that we'd rather be vulnerable? Edit to add: I'm not an expert, but I'm competent enough to force a certain level of crypto o…

NSA almost definitely can't buy a computer that can break 2048 bit conventional multiplicative group discrete logs, and if by same insane space-alien-technology chance they can, the implication is that conventional multiplicative group discrete logs are probably entirely unsuitable for secure cryptography: no amount of jazz-hands with parameters will save you.

Reminder: 2048 bit discrete logs aren't just twice as hard as 1024 bit discrete logs!

Yes: 2048 bit RSA and DH are significantly slower than 1024 bit, and that's a big part of why they're still in use.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#33

Post by PlzSnow »

kordless wrote: post #7
diafygi wrote: post #2

Does anyone have links to bugs for the affected programs to make 2048 the minimum by default? It seems like we shouldn't have to continue to manually configure secure settings. OpenVPN? SSH? Nginx? Apache? Where are the bugs to make these not use insecure dhparams by default?

FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers. Assuming they have, the challenge is then defined as determining which applications and sites tend to use these standardized or hard-coded primes. > Breaking a second 1024-bit prime would allow passive eavesdropping on connectio…

"FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers."

This is just nonsense. Am I the only sane one here? Can no-one else see that the response is hysterical? There's no evidence whatsover that any of this has happened. It's conspiracy conjecture.

Look, I know the cultural narrative on HN is that the NSA is the all-seeing-eye, but can't we have a sensible discussion about this? Because it's embarrassing for me to be active on a website that reverts to the mean conspiracy theory of the world.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#34

Post by mentat »

PlzSnow wrote: post #31
olympus wrote: post #24

This recent publication illustrates a problem that we have trying to keep our communications secure. If we all use a single "strong" prime number with our crypto then the NSA has a huge incentive to pre-compute results from that single strong number. Now that we know that the NSA is doing this, we won't all use a proven strong number, and we will all start to do key exchanges with another method, and it will become t…

"If we all use a single "strong" prime number with our crypto then the NSA has a huge incentive to pre-compute results from that single strong number. Now that we know that the NSA is doing this" We don't know the NSA is doing this. There's no evidence whatsoever beyond conspiracy theory stuff.

Except, you know, actual leaked documents and it being the most reasonable expectation for their claimed capabilities.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#35

Post by PlzSnow »

mentat wrote: post #34
PlzSnow wrote: post #31

Earlier quoted context omitted.

"If we all use a single "strong" prime number with our crypto then the NSA has a huge incentive to pre-compute results from that single strong number. Now that we know that the NSA is doing this" We don't know the NSA is doing this. There's no evidence whatsoever beyond conspiracy theory stuff.

Except, you know, actual leaked documents and it being the most reasonable expectation for their claimed capabilities.

IOW no evidence whatsoever.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#36

Post by cnt0 »

windexh8er wrote: post #16
agwa wrote: post #15

Earlier quoted context omitted.

3DES (the cipher) is secure but incredibly slow. It's often included in server ciphersuites to support old clients (the alternative for old clients is RC4, which is not secure). Edit: I should mention though that 3DES as used in TLS is vulnerable to BEAST if not mitigated client-side and possibly Lucky 13 too, so the ciphersuite ought to be the next to "go" along with the other CBC ciphersuites. Still better than RC4…

Thank you I had an idea of the performance delta. But, comparatively (to something like TLS_RSA_WITH_AES_[256|128]_CBC_SHA) how does it compare? Edit: Thanks for the edit! What I was looking for.

Very poorly: http://zombe.es/post/4078724716/openssl-cipher-selection

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#37

Post by rogeryu »

PlzSnow wrote: post #31
olympus wrote: post #24

This recent publication illustrates a problem that we have trying to keep our communications secure. If we all use a single "strong" prime number with our crypto then the NSA has a huge incentive to pre-compute results from that single strong number. Now that we know that the NSA is doing this, we won't all use a proven strong number, and we will all start to do key exchanges with another method, and it will become t…

"If we all use a single "strong" prime number with our crypto then the NSA has a huge incentive to pre-compute results from that single strong number. Now that we know that the NSA is doing this" We don't know the NSA is doing this. There's no evidence whatsoever beyond conspiracy theory stuff.

> We don't know the NSA is doing this. There's no evidence whatsoever beyond conspiracy theory stuff.

We don't know the NSA is not doing this. There is ample evidence that they do a lot more than we conspired about.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#38

Post by jokoon »

I get that NSA snooping is abusive if it's the norm. But who exactly would really want to protect themselves from the NSA?

I mean ultimately, isn't the problem the NSA is snooping on people who aren't aware of it ? Why would someone try to hide itself from the NSA ? Is it just because it's a political principle or to just annoy the NSA and discourage them ? I mean wouldn't this help the bad guys more ?

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#39

Post by ck2 »

Is this really a "best practice" to disable dhe in firefox/chrome?

Won't that just make the server/browser negotiate an even weaker scheme if they cannot find a matching higher set?

My firefox goes from:

    TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
    TLS_DHE_RSA_WITH_AES_128_CBC_SHA
    TLS_DHE_RSA_WITH_AES_256_CBC_SHA
    TLS_RSA_WITH_AES_128_CBC_SHA
    TLS_RSA_WITH_AES_256_CBC_SHA
    TLS_RSA_WITH_3DES_EDE_CBC_SHA
to:

    TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
    TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
    TLS_RSA_WITH_AES_128_CBC_SHA
    TLS_RSA_WITH_AES_256_CBC_SHA
    TLS_RSA_WITH_3DES_EDE_CBC_SHA
Do you really want TLS_RSA? How about 3DES?

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#40

Post by jMyles »

jokoon wrote: post #38

I get that NSA snooping is abusive if it's the norm. But who exactly would really want to protect themselves from the NSA? I mean ultimately, isn't the problem the NSA is snooping on people who aren't aware of it ? Why would someone try to hide itself from the NSA ? Is it just because it's a political principle or to just annoy the NSA and discourage them ? I mean wouldn't this help the bad guys more ?

One of the main things I want to keep private is just family life - conflicts, love, sex, etc. I don't want the government to know about my private family life. I don't see how a free, thoughtful, creative society can flourish if the government can always know the goods on everybody.
Post reply on HN