Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Protect Yourself from NSA Attacks on 1024-bit DH

eff.org

Post reply on HN
Print view View original

81–90 of 140 posts

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#81

Post by kentt »

mikelyons wrote: post #76

Wont this just prompt NSA to crack the others if they see a spike in disabled crackables?

Valid concern, but that's a bit a defeatist attitude. Yes if we all switch to more secure encryption, they will try to crack or cripple those, but to crack 1024 DH was a multi billion dollar effort (just on the cusp of what it feasible for them). If we can use something more secure, then it's out of their ability. The good part is that often we can increase the difficulty to crack something by an order of magnitude without a high cost to us.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#82

Post by MrRadar »

tptacek wrote: post #75
MrRadar wrote: post #21

Earlier quoted context omitted.

From what we know as long as it is a custom 1024-bit DH key and you're not being actively targeted by the NSA you are probably okay. That said, you should still upgrade to 2048-bit (or higher, if you're paranoid) ASAP.

No, this is terrible advice. Stop using DH-1024.

Hence "That said, you should still upgrade to 2048-bit (or higher, if you're paranoid) ASAP."

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#83

Post by kentt »

jokoon wrote: post #38

I get that NSA snooping is abusive if it's the norm. But who exactly would really want to protect themselves from the NSA? I mean ultimately, isn't the problem the NSA is snooping on people who aren't aware of it ? Why would someone try to hide itself from the NSA ? Is it just because it's a political principle or to just annoy the NSA and discourage them ? I mean wouldn't this help the bad guys more ?

Anyone who values privacy should care.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#84

Post by hsivonen »

yuhong wrote: post #80
hsivonen wrote: post #79

Sadly, users who follow this advice will forget that they did by the time they can't figure out why connections fail to servers that have been configured for forward secrecy only but run an ECC-incapable version of Apache (thanks to long-term support Linux distros keeping old Apache around).

Apache decides the DHE keys, OpenSSL decides the ciphersuites used. Red Hat didn't even enable ECDHE until they moved to OpenSSL 1.0.1 in RHEL 6.5 in late 2013.

Last I checked (updates may have fixed this), Ubuntu 12.04 had ECC-capable OpenSSL but ECC-incapable Apache.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#86

Post by URSpider94 »

PlzSnow wrote: post #33
kordless wrote: post #7

Earlier quoted context omitted.

FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers. Assuming they have, the challenge is then defined as determining which applications and sites tend to use these standardized or hard-coded primes. > Breaking a second 1024-bit prime would allow passive eavesdropping on connectio…

"FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers." This is just nonsense. Am I the only sane one here? Can no-one else see that the response is hysterical? There's no evidence whatsover that any of this has happened. It's conspiracy conjecture. Look, I know the cultural narrat…

Ok, how's this for sensible? The holy trinity of criminal law is means, motive and opportunity. Let's review:

Does the NSA have the means for such an attack? The article argues convincingly that they do.

Does the NSA have the motive for such an attack? Yes, if their mission is to gain access to as much of the signals traffic in the world as possible -- and I think that's been pretty well shown to be true.

Does the NSA have the opportunity for such an attack? Certainly, the Snowden papers have shown that the NSA has access to a wide variety of communications channels.

So, I think it's a perfectly sane argument to say that if the NSA haven't performed this attack already, they will certainly do so at some point in time against some target. And, if they are not, state intelligence organizations under other flags, such as China, will -- and China has shown a clear interest in attacking not just military but also commercial targets within the USA.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#87

Post by kordless »

detaro wrote: post #68
PlzSnow wrote: post #33

Earlier quoted context omitted.

"FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers." This is just nonsense. Am I the only sane one here? Can no-one else see that the response is hysterical? There's no evidence whatsover that any of this has happened. It's conspiracy conjecture. Look, I know the cultural narrat…

Why is it not a reasonable assumption that the NSA (and possibly other actors with the means) are doing so? / Why wouldn't you do it in their position?

The only reasonable assumption I can come up with for not cracking the stock primes would be expense and inability to execute on a plan. Otherwise, it makes perfect sense to crack them. And, talk about fun and interesting work!

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#89

Post by mynameisvlad »

rtb wrote: post #23
agwa wrote: post #8

Earlier quoted context omitted.

There's nothing inherently wrong with the DHE ciphersuites, as long as the server provides secure parameters. Since weakdh is really a server-side issue, and howsmyssl.com is a client-side test, a warning doesn't really make sense.

... but clients can guard against weak server-side DHE by rejecting DHE ciphersuites. So I think the GP was correct that this diagnostic should be updated.

No, because as agwa pointed out, howsmyssl checks client security. There's nothing wrong with a DHE cipher suite and it can be used in a secure manner quite easily. Since this is wholly on the server, and howsmyssl has no way of testing a server you're connecting to, then there's no possible way for it to know if your specific connections are okay or not. Based solely on the client suites tested, DHE would still be considered secure. It's only the interaction with an insecure server that makes it insecure.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#90

Post by JoshTriplett »

PlzSnow wrote: post #33
kordless wrote: post #7

Earlier quoted context omitted.

FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers. Assuming they have, the challenge is then defined as determining which applications and sites tend to use these standardized or hard-coded primes. > Breaking a second 1024-bit prime would allow passive eavesdropping on connectio…

"FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers." This is just nonsense. Am I the only sane one here? Can no-one else see that the response is hysterical? There's no evidence whatsover that any of this has happened. It's conspiracy conjecture. Look, I know the cultural narrat…

Cryptography based on limitations of computing power has to make the assumption that if the computing power required is even potentially within reach of any existing organization, or within orders of magnitude of being within reach, it's long past time to migrate away. It doesn't matter if the capability has in fact been developed; if it seems even remotely feasible, time to migrate to better crypto.

Moving to 2048 or 4096, or to ECC, thus seems like a prudent step whether you believe such intercept capabilities actually exist or not.

Post reply on HN