Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to Protect Yourself from NSA Attacks on 1024-bit DH

eff.org

Post reply on HN
Print view View original

101–110 of 140 posts

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#101

Post by thephyber »

valarauca1 wrote: post #26
vitd wrote: post #11

Anyone have a way to fix up Safari on OS X 10.11?

You can't fix this on the client side, but on the server side.

Please read the article before posting. There _are_ some things that can be done client side to raise the minimum level of encryption, although not to raise the maximum level of encryption.

One tactic the NSA and at least one vendor are suspected to use is to inject/drop a header which prevents the client and server of an SSL/TLS connection from settling on the highest level of encryption that both the client and server have. In this case, it's best for your client to disable the weakest forms of SSL/TLS encryption which raises the minimum level of encryption of the connection.

That's what much of this EFF article describes, although it fails to describe these steps for browsers other than Firefox and Chrome.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#102

Post by bediger4000 »

detaro wrote: post #68
PlzSnow wrote: post #33

Earlier quoted context omitted.

"FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers." This is just nonsense. Am I the only sane one here? Can no-one else see that the response is hysterical? There's no evidence whatsover that any of this has happened. It's conspiracy conjecture. Look, I know the cultural narrat…

Why is it not a reasonable assumption that the NSA (and possibly other actors with the means) are doing so? / Why wouldn't you do it in their position?

I would not do it if I was in their position. I'm a US citizen, so I believe in upholding the constitution, which includes a prohibition on unreasonable search and seizure. Whatever the lawyers and judges have made "unreasonable" out to be, NSA dragnet surveillance is way beyond "reasonable" and on into "police state" territory.

Also, I'm not a pervert who gets kicks from listening to others' conversations. They apparently are.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#103

Post by alwillis »

lukeasrodgers wrote: post #51

If you're having trouble following the instructions to secure SSH on OSX, try following the directions here: https://mochtu.de/2015/01/07/updating-openssh-on-mac-os-x-10... Without using the brew dupe and ` --with-keychain-support` flag, I was getting cipher errors when trying to use SSH after following the instructions linked to in TFA. NB: I am not a security expert.

A great article on securing SSH is "Secure Secure Shell”: https://stribika.github.io/2015/01/04/secure-secure-shell.ht...

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#105

Post by scintill76 »

hsivonen wrote: post #84
yuhong wrote: post #80

Earlier quoted context omitted.

Apache decides the DHE keys, OpenSSL decides the ciphersuites used. Red Hat didn't even enable ECDHE until they moved to OpenSSL 1.0.1 in RHEL 6.5 in late 2013.

Last I checked (updates may have fixed this), Ubuntu 12.04 had ECC-capable OpenSSL but ECC-incapable Apache.

tlsinterposer[0] helps in cases like this. (tldr: LD_PRELOAD middleware to upgrade an application's OpenSSL support without modifying the application.)

[0] https://github.com/Netfuture/tlsinterposer

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#106

Post by cinquemb »

snuxoll wrote: post #58
olympus wrote: post #29

Earlier quoted context omitted.

> don't use weak moduli. By this do you mean don't use 1024 bit keys? Would using 2048 bit (or larger) mean that the NSA wouldn't be able to buy a computer that could do the computation within a year? Why don't we all use 2048 bit keys then? Is the communication and processing overhead so high that we'd rather be vulnerable? Edit to add: I'm not an expert, but I'm competent enough to force a certain level of crypto o…

> By this do you mean don't use 1024 bit keys? Would using 2048 bit (or larger) mean that the NSA wouldn't be able to buy a computer that could do the computation within a year? Keep in mind, going from 1024 to 2048 bit DH parameters doesn't double the search space, it raises it from 2^1024 to 2^2048. At some point the search space gets so large that you'd need more energy than required to boil all of Earth's oceans…

I haven't had much crypto-in-practice background (outside of thought experiments), but I have some math background so I'm quite curious. Shouldn't people also be worried about non brute force attacks based on finding mathematical solutions? I mean, "The Uneasy Relationship Between Mathematics and Cryptography"[0]?

[0] http://www.ams.org/notices/200708/tx070800972p.pdf

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#107

Post by X-Istence »

devit wrote: post #71

Is there any reason why in TLS the DH g^x the client sends is not encrypted with the server's RSA key? That way, a DH compromise merely lose forward secrecy and the data would still be safe as long as the server private keys are not compromised.

Because you can have anonymous TLS connections that only use DH for forward security.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#108

Post by alwillis »

My big picture take-away is:

It seems that the NSA (and possibly other state-level actors) can access encrypted traffic that uses 1024-bit Diffie-Hellman that use commonly-used prime numbers. This means HTTPS, SSH, IPsec, SMTPS, and protocols that rely on TLS are potentially vulnerable. Where’s there’s smoke, there’s fire and there’s a lot of smoke indicating the NSA can do this. They have the money, technology, infrastructure and the technical ability to pull this off.

From https://weakdh.org: >Breaking the single, most common 1024-bit prime used by web servers would allow passive eavesdropping on connections to 18% of the Top 1 Million HTTPS domains. A second prime would allow passive decryption of connections to 66% of VPN servers and 26% of SSH servers. A close reading of published NSA leaks shows that the agency’s attacks on VPNs are consistent with having achieved such a break.

This is real.

It’s all of the networking infrastructure that no longer gets software/firmware updates running 512, 768 and 1024-bit Diffie-Hellman that are likely already being exploited, not to mention all of the old VPNs, email servers, SSH clients, etc. that can’t be easily upgraded and can’t use more secure encryption protocols. After all of the hoopla dies down, this is the ongoing problem.

But don’t panic.

On current operating systems, going to larger 2048-bit Diffie-Hellman or using Elliptic-Curve Diffie-Hellman Key Exchange (ECDH) addressed the problem. As has been pointed out several times, 2048-bit Diffie-Hellman isn’t double the strenght of 1024-bit Diffie-Hellman; we’re going from a keyspace of 2^1024 to 2^2048. So unless there’s an unprecedented crytography breakthrough or quantum computers start sprouting like Dandelions, 2048-bit Diffie-Hellman is firmly in the "it would take more energy than what would be required to boil all of the oceans on Earth" arena.

If you’re going the ECDHE route, everyone agrees that the NIST curves are suspect and that Curve25519: http://cr.yp.to/ecdh.html is what you want. More at SafeCurves: http://safecurves.cr.yp.to.

If you keep up with current cryptography trends, you’re probably already in a good place, but it doesn’t hurt to check. There are lots of guides on how to get your stuff right:

* Secure Secure Shell: https://stribika.github.io/2015/01/04/secure-secure-shell.ht...

* Mozilla's Security/Guidelines/OpenSSH: https://wiki.mozilla.org/Security/Guidelines/OpenSSH

* Guide to Deploying Diffie-Hellman for TLS: https://weakdh.org/sysadmin.html

* Qualys SSL Server Test: https://www.ssllabs.com/ssltest/index.html

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#109

Post by facetube »

detaro wrote: post #68
PlzSnow wrote: post #33

Earlier quoted context omitted.

"FWIU of the situation, we have reason to suspect the government has 'cracked' the default large primes that are commonly used by a bunch of different software packages, including web servers." This is just nonsense. Am I the only sane one here? Can no-one else see that the response is hysterical? There's no evidence whatsover that any of this has happened. It's conspiracy conjecture. Look, I know the cultural narrat…

Why is it not a reasonable assumption that the NSA (and possibly other actors with the means) are doing so? / Why wouldn't you do it in their position?

Because this particular military spy organisation is being deployed by the US government against its own citizens, en masse, as an end-around well-established due process and constitutional protections that require individualised suspicion of wrongdoing. It also represents a giant exfiltration target for other state actors, like those who breached OPM. NSA hurts the security of Americans under the guise of preventing foreign terrorism, which happens to pose a risk comparable to lightning strikes.

Re: How to Protect Yourself from NSA Attacks on 1024-bit DH

#110

Post by DiabloD3 »

tikums wrote: post #93
agwa wrote: post #3

The OpenVPN section is misleading. The dh option is only supported on the server side. If you try to use it on the client side (which is what this guide appears to be tailored towards) it will be ignored and you'll use whatever DH parameters the server provides.

It may be misleading but also in the sense that there's no recommendation to just drop VPN altogether. How about we just stop relying on terribly over-designed protocols such as VPN and IPSec? Complexity is the enemy of security.

We use OpenVPN at work to provide layer 2 access to a management network that uses a /24 out of the 10/8 range.

How else do you think we should do this?

Post reply on HN