NYU Accidentally Exposed Military Code-Breaking Computer

Widespread modern encryption methods like RSA, named for the initials of the cryptographers who developed it, rely on the use of hugely complex numbers derived from prime numbers. Speaking very roughly, so long as those original prime numbers remain secret, the integrity of the encoded data will remain safe. But were someone able to factor the hugely complex number — a process identical to the sort of math exercise children are taught to do on a chalkboard, but on a massive scale — they would be able to decode the data on their own. Luckily for those using encryption, the numbers in question are so long that they can only be factored down to their prime numbers with an extremely large amount of computing power. Unluckily for those using encryption, government agencies in the U.S., Norway, and around the globe are keenly interested in computers designed to excel at exactly this purpose.

The point of modern RSA is that we use a modulus that can't be factored by any conceivable computer, with limits derived from the physics of computation and projected far out into the future. We aren't a supercomputer advance away from factoring 2048 bit moduli. The government's "keen interest" in that problem is irrelevant.

We've known for coming up on 2 decades, at least (from Eran Tromer in 2001-2003) that 1024 bit moduli aren't safe. There's been speculation for years that the NSA is standing up giant compute clusters in Utah to target 1024 bit discrete logs (it's speculation because it's hard to see how those attacks make economic sense, even with advances in batch attacks). If we want to suppose that IBM and NSA are mounting a supercomputing attack on weak crypto, fine. The presumption that these attacks will get more viable is why, for instance, the WebPKI is urgently scrubbing itself of 1024 bit keys and has been for years.

But that's not what this article says. Instead, it puts forward a narrative that the USG is collaborating with IBM to build supercomputers that would break all of RSA. Not only is that not what's happening, but if it was, IBM and the USG would be doing us a great service, because we can't rely on cryptography that is a supercomputing advance away from being broken.

Needless to say, they're not really doing us a service, and they're not really about to break RSA, and breaking RSA isn't a really big IBM purchase order away from happening.

The paragraph you quote was intended to give an overview of one type of work a machine like WindsorGreen might do, in broad terms. While it's true we mention RSA as a very basic example of the sort of thing a government would be /interested/ in breaking, we also specifically quote a security researcher saying WindsorGreen “might also have applications for things like … breaking older/weaker (1024 bit) RSA keys” and then quote another (bunnie) saying "“Even if [WindsorGreen] gave a 100x advantage in cracking strength, it’s a pittance compared to the additional strength conferred by going from say, 1024-bit RSA to 4096-bit RSA or going from SHA-1 to SHA-256.”

It's really not clear to me how the piece "puts forward a narrative that the USG is collaborating with IBM to build supercomputers that would break all of RSA" -- indeed, it specifically says this would be of use primarily against 1024-bit RSA.

That said, I'm definitely curious how you think the piece could have framed this more obviously for the lay reader.

(If it's not clear, I work at The Intercept.)

Is this maybe the Cyrogenic Computer Complexity Program? [1] That's an attempt to build a 10GHz machine running in liquid helium.

[1] https://www.fbo.gov/index?s=opportunity&mode=form&tab=core&i...

Although the experts quoted only mention 1024-bit keys as targets of attack, the particular paragraph that Thomas mentioned really seems to suggest that RSA in general may be within reach. The worst problem is the last two sentences:

> Luckily for those using encryption, the numbers in question are so long that they can only be factored down to their prime numbers with an extremely large amount of computing power. Unluckily for those using encryption, government agencies in the U.S., Norway, and around the globe are keenly interested in computers designed to excel at exactly this purpose.

This doesn't mention anything about key lengths, but in a sense key lengths are nearly the whole story with regard to the feasibility of brute-force attacks against RSA. Particularly, both sentences refer to "those using encryption" as an undifferentiated class put at risk by this sort of project, and that's one thing that particularly suggests that all of RSA is at risk.

I'm sure it's gotten a lot tougher out there for this kind of thing since the Comodo and DigiNotar attacks. Looking forward to more mandatory CT mechanisms!