Unsafe RSA primes conjectured
mathoverflow.net
Unsafe RSA primes conjectured
1–10 of 59 posts
Re: Unsafe RSA primes conjectured
#2A related public key news:
https://arstechnica.com/information-technology/2017/10/crypt...
It compromises the TPM 1.2 and Microsoft Bitlocker HDD encruption.
The researchers also scanned the Internet for fingerprinted keys and quickly found hits in a variety of surprising places. They found 447 fingerprinted keys—237 of them factorizable—used to sign GitHub submissions, some for very popular software packages. GitHub has since been notified of the fingerprinted keys and is in the process of getting users to change them.
The researchers also found 2,892 PGP keys used for encrypted e-mail, 956 of which were factorizable. The researchers speculated that the majority of the PGP keys were generated using the Yubikey 4, which allows owners to use the faulty library to create on-chip RSA keys. Other functions of the USB device, including U2F authentication, remain unaffected. Yubico has more details here.
Re: Unsafe RSA primes conjectured
#3A related public key news: https://arstechnica.com/information-technology/2017/10/crypt... It compromises the TPM 1.2 and Microsoft Bitlocker HDD encruption. The researchers also scanned the Internet for fingerprinted keys and quickly found hits in a variety of surprising places. They found 447 fingerprinted keys—237 of them factorizable—used to sign GitHub submissions, some for very popular software packages. GitHub…
is there a reason why bitlocker would use rsa for encryption? afaik how bitlocker worked with tpm was that it would generate a (symmetric) key, store it in the tpm, then seal it, binding it to the current PCR value. on boot, it would unseal it (which will succeed unless the PCR changed).
Re: Unsafe RSA primes conjectured
#4How many primes within the usual range generated for RSA happen to fit the form 27a^2 + 27a + 7?
Re: Unsafe RSA primes conjectured
#5Werner Koch is starting to look less like a quack after the discovery of this conjecture. He's been pushing to deprecate gpg RSA in general, and is evidenced to have taken a step toward this goal in the latest 2.1 release with ed25519 support.
Re: Unsafe RSA primes conjectured
#6A related public key news: https://arstechnica.com/information-technology/2017/10/crypt... It compromises the TPM 1.2 and Microsoft Bitlocker HDD encruption. The researchers also scanned the Internet for fingerprinted keys and quickly found hits in a variety of surprising places. They found 447 fingerprinted keys—237 of them factorizable—used to sign GitHub submissions, some for very popular software packages. GitHub…
What are the odds that this was intentional? TPM and Bitlocker have been two of the biggest conjectured targets of compromise. To the point that most security people/libraries use neither. Maybe they were right?
If this is true one of Stackoverflow comments is quite chilling
It would be a terrible idea and it would raise suspicions of a deliberate trapdoor if the primes for RSA were chosen from a quadratic progression rather than randomly
Re: Unsafe RSA primes conjectured
#7It has always been the case that RSA keys should not have primes of certain forms. IIRC there are some forms that are preferred too.
Re: Unsafe RSA primes conjectured
#8How many primes within the usual range generated for RSA happen to fit the form 27 a^2 + 27 a + 7?
Primes are much denser (1/log n).
Re: Unsafe RSA primes conjectured
#9Werner Koch is starting to look less like a quack after the discovery of this conjecture. He's been pushing to deprecate gpg RSA in general, and is evidenced to have taken a step toward this goal in the latest 2.1 release with ed25519 support.
What's his reasoning, and how does this conjecture fit into it?
Re: Unsafe RSA primes conjectured
#10Why is this significant?