Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

NYU Accidentally Exposed Military Code-Breaking Computer

theintercept.com

Post reply on HN
Print view View original

41–50 of 65 posts

Re: NYU Accidentally Exposed Military Code-Breaking Computer

#41

Post by tptacek »

tptacek wrote: post #13
schoen wrote: post #11

The greatest brute-force attack successes that we know of are generally reversing password hashes, because the input spaces and/or effective input spaces under some model of a password's structure are so small. People have achieved very effective results with that, often using special hardware. The most common attack model for this is "get ahold of a hashed password list, try to reverse as many as possible, then try…

This is off the top of my head and I'd welcome correction: Large scale password cracking has a much clearer payoff than attacks on 1024 bit DH, which have to be targeted to individual (probably TLS) connections. The RSA that most of the Internet depends on is brokered by CAs --- so, problem 1, the USG already owns CAs and doesn't need supercomputers to get valid certificates, problem 2, the most valuable "authentic"…

A friend pointed out privately that a more realistic target for this kind of firepower is IPSEC VPNs, which overwhelmingly use finite field Diffie Hellman. So there's that.

Re: NYU Accidentally Exposed Military Code-Breaking Computer

#42

Post by tptacek »

dsl wrote: post #34
schoen wrote: post #15

Earlier quoted context omitted.

I suppose I'm also wondering if there's an authentication protocol where the challenger actually tells the prover what hash it has to match. Does a challenger ever effectively say "Please tell me the secret whose SHA256 is equal to fcdf324499312efa027b5033513b0c0968f74ae7ba81a271ae62b3dda2cd4143 in order to proceed"? Maybe protocols where the attacker has access to a signature over some data, but doesn't get access t…

Think about any software updates you do (Windows Update, apt, yum, etc). All these systems rely on distributing a cryptographic ally signed manifest of what each files hash should be. If you can forge the hash of a file, or the signature on that manifest, there are hundreds of different ways you can easily replace one file for another in transit over the internet.

We're also not a supercomputer advance away from breaking SHA2. There are hash-designing cryptographers who believe we may never break SHA2 with conventional computers.

Re: NYU Accidentally Exposed Military Code-Breaking Computer

#43

Post by exhilaration »

dguido wrote: post #35

Nothing in this article remotely qualifies as news. IBM builds computers, fast ones, to crack passwords for the US DOD. They engage with academia to apply research in building and programming them. Is that surprising? Even if it were, there's not even a source document in the article. Snoozefest.

I think this is newsworthy:

Andrew "Bunnie" Huang: "My guess is this thing, compared to the TOP500 supercomputers at the time (and probably even today) pretty much wipes the floor with them for anything crypto-related."

We've always guessed the NSA has some incredible resources, but to get a peek like this into what they had 3 years ago is definitely newsworthy. It makes the whole supercomputing race kind of a joke if governments have massively more powerful machines hidden from public view.

Re: NYU Accidentally Exposed Military Code-Breaking Computer

#44

Post by schoen »

dsl wrote: post #34
schoen wrote: post #15

Earlier quoted context omitted.

I suppose I'm also wondering if there's an authentication protocol where the challenger actually tells the prover what hash it has to match. Does a challenger ever effectively say "Please tell me the secret whose SHA256 is equal to fcdf324499312efa027b5033513b0c0968f74ae7ba81a271ae62b3dda2cd4143 in order to proceed"? Maybe protocols where the attacker has access to a signature over some data, but doesn't get access t…

Think about any software updates you do (Windows Update, apt, yum, etc). All these systems rely on distributing a cryptographic ally signed manifest of what each files hash should be. If you can forge the hash of a file, or the signature on that manifest, there are hundreds of different ways you can easily replace one file for another in transit over the internet.

That's a very different attack than I was looking for; you've described a second preimage attack, which would be considered a fundamental weakness of the hash. I was looking for a protocol where a comparatively small amount of signed data (let's say less than 90 bits) is kept secret, but can potentially be brute-forced on an appropriate supercomputer.

Re: NYU Accidentally Exposed Military Code-Breaking Computer

#45

Post by schoen »

exhilaration wrote: post #43
dguido wrote: post #35

Nothing in this article remotely qualifies as news. IBM builds computers, fast ones, to crack passwords for the US DOD. They engage with academia to apply research in building and programming them. Is that surprising? Even if it were, there's not even a source document in the article. Snoozefest.

I think this is newsworthy: Andrew "Bunnie" Huang: "My guess is this thing, compared to the TOP500 supercomputers at the time (and probably even today) pretty much wipes the floor with them for anything crypto-related." We've always guessed the NSA has some incredible resources, but to get a peek like this into what they had 3 years ago is definitely newsworthy. It makes the whole supercomputing race kind of a joke i…

Apparently the context suggests this particular machine had not been built and delivered at the time the documents were written, so it doesn't show that NSA had this exact machine at that time (though maybe they had other computers that were this fancy or fancier).

Re: NYU Accidentally Exposed Military Code-Breaking Computer

#46

Post by tptacek »

schoen wrote: post #15
tptacek wrote: post #13

Earlier quoted context omitted.

This is off the top of my head and I'd welcome correction: Large scale password cracking has a much clearer payoff than attacks on 1024 bit DH, which have to be targeted to individual (probably TLS) connections. The RSA that most of the Internet depends on is brokered by CAs --- so, problem 1, the USG already owns CAs and doesn't need supercomputers to get valid certificates, problem 2, the most valuable "authentic"…

I suppose I'm also wondering if there's an authentication protocol where the challenger actually tells the prover what hash it has to match. Does a challenger ever effectively say "Please tell me the secret whose SHA256 is equal to fcdf324499312efa027b5033513b0c0968f74ae7ba81a271ae62b3dda2cd4143 in order to proceed"? Maybe protocols where the attacker has access to a signature over some data, but doesn't get access t…

I think you're describing most KDF attacks, of which password hashes are particular (and easy) example. I can't think of an instance of this attack that isn't password hashes that is so widely deployed that it would be economical to invest in 9-figure supercomputers to attack it, but that obviously doesn't mean one doesn't exist.

Re: NYU Accidentally Exposed Military Code-Breaking Computer

#48

Post by mapgrep »

tptacek wrote: post #37
schoen wrote: post #18

Earlier quoted context omitted.

I'm guessing Thomas thinks that only problems that supercomputers can, in fact, usefully attack should be mentioned as the likely targets of this computer. :-) Although the experts quoted only mention 1024-bit keys as targets of attack, the particular paragraph that Thomas mentioned really seems to suggest that RSA in general may be within reach. The worst problem is the last two sentences: > Luckily for those using…

This exactly. Thanks for saying it more clearly than I could.

I appreciate the explanation from schoen, I can grasp the argument more clearly.

I do believe that is an aggressive reading of the paragraph, out of its context, and that "malpractice" is unfair.

The paragraph you quoted is followed, after just a single intervening paragraph, by this, which I would argue speaks explicitly and accurately to your point:

---

A very important question remains: What exactly could WindsorBlue, and then WindsorGreen, crack? Are modern privacy mainstays like PGP, used to encrypt email, or the ciphers behind encrypted chat apps like Signal under threat? The experts who spoke to The Intercept don’t think there’s any reason to assume the worst.

“As long as you use long keys and recent-generation hashes, you should be OK,” said Huang. “Even if [WindsorGreen] gave a 100x advantage in cracking strength, it’s a pittance compared to the additional strength conferred by going from say, 1024-bit RSA to 4096-bit RSA or going from SHA-1 to SHA-256.”

Translation: Older encryption methods based on shorter strings of numbers, which are easier to factor, would be more vulnerable, but anyone using the strongest contemporary encryption software (which uses much longer numbers) should still be safe and confident in their privacy.

---

If someone read a sentence saying encryption users are unlucky that the U.S. government is buying supercomputers to crack encryption, which used RSA as an example of something the government wanted to crack, and concluded that this means RSA is broken, they would be cleared of this misreading within a few paragraphs, no?

We are diligent in our reporting, research, editing, and fact checking; this piece involved no small number of staffers doing all of those things and more. A term like "malpractice" we take seriously, but seems to have been tossed off a bit casually here.

Re: NYU Accidentally Exposed Military Code-Breaking Computer

#49

Post by 21 »

tptacek wrote: post #12

This is malpractice: Widespread modern encryption methods like RSA, named for the initials of the cryptographers who developed it, rely on the use of hugely complex numbers derived from prime numbers. Speaking very roughly, so long as those original prime numbers remain secret, the integrity of the encoded data will remain safe. But were someone able to factor the hugely complex number — a process identical to the so…

> The point of modern RSA is that we use a modulus that can't be factored by any conceivable computer, with limits derived from the physics of computation and projected far out into the future.

I'm sure you know about quantum computers. So what am I missing here? Surely they are a conceivable computer with a practical realization some decades away.

Re: NYU Accidentally Exposed Military Code-Breaking Computer

#50

Post by tptacek »

21 wrote: post #49
tptacek wrote: post #12

This is malpractice: Widespread modern encryption methods like RSA, named for the initials of the cryptographers who developed it, rely on the use of hugely complex numbers derived from prime numbers. Speaking very roughly, so long as those original prime numbers remain secret, the integrity of the encoded data will remain safe. But were someone able to factor the hugely complex number — a process identical to the so…

> The point of modern RSA is that we use a modulus that can't be factored by any conceivable computer, with limits derived from the physics of computation and projected far out into the future. I'm sure you know about quantum computers. So what am I missing here? Surely they are a conceivable computer with a practical realization some decades away.

Sorry, I meant "conceivable conventional computer" but forgot the extra word (I'd used it elsewhere on the thread).

If this was some crazy undocumented advance in quantum computing, I'd have written a different comment. But it's not: it's high end conventional computing, which absent some fundamental break in the integer factorization problem (in which case that break would be the story, not the supercomputer) isn't going to make a dent in RSA.

(I'm a QC skeptic, for what it's worth.)

Post reply on HN