openssl rsa -in private.key -text -noout
prime1:
00:f7:5b:73:5c:13:9b:7b:70:58:36:22:d6:25:e6:
44:15:f3:f7:b3:18:c5:11:65:77:f2:85:af:cc:79:
fa:d2:bd
prime2:
00:d4:81:b4:f5:af:a8:56:0e:a3:34:c0:e3:e8:60:
fb:b2:96:83:e2:af:6d:d7:09:3f:37:2a:bf:31:32:
cf:92:63I've factored the RSA keys of a Certificate Authority from the 90s
61–70 of 132 posts
Re: I've factored the RSA keys of a Certificate Authority from the 90s
#62I am not a cryptography expert but I am interested in the field. Having said that: I am lately having an hard time understanding the actual strength of a crypto suite based on the underlying problem, the sized of the material and the computation strength needed to break it either via optimization and parallelism capabilities.
> The Web PKI deprecated 1024-bit RSA over a decade ago, and while I don’t know of anyone factoring a key of that size, it’s within the realm of possibility for a government or other organization with a large number of computers.
Is it? How do I verify such claim?
---
> Just a few days ago, someone factored the 862-bit RSA-260 key from the RSA factoring challenge.
Yeah, but how much time it required? and what about the resources? It is just a number, it is not all the 861 bits n numbers.
Re: I've factored the RSA keys of a Certificate Authority from the 90s
#63I am not a cryptography expert but I am interested in the field. Having said that: I am lately having an hard time understanding the actual strength of a crypto suite based on the underlying problem, the sized of the material and the computation strength needed to break it either via optimization and parallelism capabilities. > The Web PKI deprecated 1024-bit RSA over a decade ago, and while I don’t know of anyone fa…
This article from 2000 is about estimating what would be required to factor 1024 bit RSA:
A Cost-Based Security Analysis of Symmetric and Asymmetric Key Lengths https://cr.yp.to/bib/2000/silverman.pdf
It was a response to the idea that 1024 bit RSA was under threat at the time.
Re: I've factored the RSA keys of a Certificate Authority from the 90s
#64> While I haven’t verified this LLM output is entirely trustworthy, it looks pretty plausible. It's essential that you do, because generating pretty plausible outputs is an LLM's bread and butter. Otherwise, only the one that you actually tested should be expected to be correct.
For a problem like this it doesn't matter. The part the LLM generated was a hurdle to clear on the way to the final result. Once the final result was achieved, you know the earlier step was valid enough to get there.
The OP is separately advertising a list of all the keys.
Re: I've factored the RSA keys of a Certificate Authority from the 90s
#65Basically 2 days on a consumer GPU to crack a 512 bit cert. The thing is much of the traffic back then did not use ephemeral keys. Most of it wasn't even encrypted at all! But about a decade later, it became normal to encrypt everything. I do wonder which governments around the world are just waiting to crack anonymous political speech by recording and saving for later when decryption can happen.
> which governments around the world are just waiting to crack anonymous political speech by recording and saving for later Probably not too many, because anonymous political speech from 10+ years ago isn't that interesting. Punishing people a decade after the fact isn't very effective for anything.
It could potentially have blackmail material.
Re: I've factored the RSA keys of a Certificate Authority from the 90s
#66Earlier quoted context omitted.
Can you point at some papers or articles that talk about attacks specifically on RSA? I've done a search and have a few references, but I'd be interested to know if you have any particular examples in mind. I know that factoring (which attacks RSA) is sub-exponential, and I know that implementations of RSA (bad choices of primes, timing attacks, etc) can have weaknesses ... I'm just interested as to whether you have…
I think you're looking for the large formula at the top here: https://en.wikipedia.org/wiki/General_number_field_sieve Reference to a scientific paper is given: https://www.ams.org/notices/199612/pomerance.pdf
That's referring to attacking the factoring problem, which is one method of attacking RSA, and as I said is known to be faster than exponential, but it felt like the comment to which I was replying was talking about something other than just faster factoring.
I know there are other attacks on RSA, I was interested to know if the poster to whom I was replying knew of any others (other than factoring, which is kinda obvious). After all, I said:
> I know that factoring (which attacks RSA) is sub-exponential, ...
Re: I've factored the RSA keys of a Certificate Authority from the 90s
#67Earlier quoted context omitted.
It’s not quite a doubling per bit, which is why RSA keys are relatively large compared to similar-strength ECDSA keys, for example. Steve Weis, who has been doing RSA factoring on some large GPU clusters, estimates factoring 1024-bit RSA would take about 2000 GPU-years, which is well within the range of anyone with a serious budget.
out of curiosity, how long would 2048-bit RSA take to factor?
My article:
2048 Bit RSA and the Year 2030 https://articles.59.ca/doku.php?id=em:20482030
We don't have any way to predict when and if 2048 bit RSA would be factorable at this time. We would need a breakthrough in hardware and/or algorithms. The common estimation that it is equivalent to the difficulty of brute forcing symmetrical 112 bit encryption seems to be based on some sort of straightforward extrapolation. It doesn't take into account the amount of memory required for the poorly reducible matrix reduction step in the currently known best algorithm. That's 10^18 bytes of memory, or a million terabytes, somehow coupled to enough processing power to actually make anything possible.
Even if you accept the 112 bit estimate, that works out to something like 400 thousand years using the Bitcoin network as a reference to what we could reasonably achieve.
Re: I've factored the RSA keys of a Certificate Authority from the 90s
#68I am not a cryptography expert but I am interested in the field. Having said that: I am lately having an hard time understanding the actual strength of a crypto suite based on the underlying problem, the sized of the material and the computation strength needed to break it either via optimization and parallelism capabilities. > The Web PKI deprecated 1024-bit RSA over a decade ago, and while I don’t know of anyone fa…
As you probably know, the computing time in the worst case scenario for brute forcing a cryptographic key generally doubles by each bit added. That is, it would take twice the effort to brute-force 129 bits compared 128 bits.
The security of RSA however depends on the factoring of very large numbers, and that means that for example, RSA-2048 doesn't translate into 2048 bits of security but 112 (roughly symmetric equivalent) bits based on the best factoring algorithms (for comparison, the RSA-512 the article mentions has an 56 bit equivalent and RSA-1024 has a 80 bit equivalent security, so RSA-1024 would take roughly 2^(80-56) ~= 17 million times to compute the worst-case scenario and RSA-2048 would take 2^(112-80) = 4.3 thousand million times more).
According to the Wikipedia article on RSA numbers, RSA-220 (66b) was factored in 2016, RSA-230 (69b) in 2018, RSA-240 (72b) in 2019 and RSA-260 (76b) this year, which is too close to RSA-1024 (80b) to be comfortable.
For RSA-250, the team reported it took "roughly 2,700 core-years, using Intel Xeon Gold 6130 CPUs at 2.1 GHz.". I am not going to (or feel qualified to) make estimates of how that would translate to RSA-1024, but it does sound plausible given enough resources.
Re: I've factored the RSA keys of a Certificate Authority from the 90s
#69In the 90s, how long did people expect it would be until consumer computer hardware would be able to do this so quickly?
It was also illegal to export software with cryptography in the early 90s, anything with keys bigger than 40 bits, so there was a lot of intentionally weak connections.
Re: I've factored the RSA keys of a Certificate Authority from the 90s
#70A bit unfortunate that so many of the interesting bits were left to ai. I would've enjoyed some commentary on why the custom TLS implementation was necessary. Oh well. Update: found this explanation in a comment at the top of the (surprisingly short) Go file in the linked repo: The target client is Netscape Communicator 4.51 (both the 40-bit export build and the 128-bit US build) with its clock set to the year 2000.…
(As the author of the post) I've written and worked on a few TLS implementations, so it wasn't terribly interesting to me. And I have to go to work tomorrow and solve real, modern CA problems :) But in short, I wanted to use Go, and it doesn't support SSLv3, the SSLv2 Client Hello, or the 40-bit RC4-MD5 export-grade cipher suites which I wanted to support too. I was more shocked that I managed to get stock OpenSSL to…
Strange seeing how people have such a hard time seeing others using AI and seem to want to complain about it instead of just, well, asking AI why something was likely done a way. It works both ways my dudes, experts don’t need to explain every last detail, prompt a bot with the context until you understand.
From my prospective, the outputs of a bot aren’t the interesting bits, it’s the input prompt that should warrant more attention.