Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bruce Schneier has changed his PGP key to 4096 bits

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 144 posts

Re: Bruce Schneier has changed his PGP key to 4096 bits

#51

Post by drdaeman »

SwellJoe wrote: post #36
vabmit wrote: post #22

Earlier quoted context omitted.

There's no need for a quantum computer. Everyone should be using at least 4096bit RSA. 1024bit RSA keys can be factored with conventional non-specialized hardware (read: CPU's, not even GPU's) with GNFS. IMHO, 2048bit RSA keys can be factored by custom hardware that the NSA has developed. I posted my reasoning for this hypothesis in other hackernews threads. A very quick/terse run down of the main key points - 1) NSA…

"2. Al Qaeda uses 2048bit RSA for internal communications 3. Most corps, diplomats, criminals, and normal people use 2048bit RSA either directly (SSH keys, Website Certs, VPNs) or indirectly (CA's still use 2048bit RSA certs valid until 2020)" I don't see how this is evidence that NSA has the ability to compromise 2048 bit keys, at will. Only that they very likely desire that ability. Math doesn't respond to desire.…

> normal people use 2048bit RSA either directly (SSH keys, Website Certs, VPNs)

Any reason for that?

[Almost] all of my SSH and TLS (be it HTTPS or OpenVPN) keys are 4096 bits long.

I wasn't woried about TLAs with supercomputers snooping on my wires, just heard that 4096 bit RSA keys are considered more secure than 2048 while not sacrificing performance much, so I just didn't have the reason to specify lower size.

Re: Bruce Schneier has changed his PGP key to 4096 bits

#52

Post by bigiain »

michiel3 wrote: post #25

In the post he also describes that he now uses a new process which involves a computer that has never been connected to the internet and its sole purpose is encrypting and decrypting files. Why not use it to encrypt and decrypt emails as well? That'd also potentially involve generating a new key pair. > 3) Assume that while your computer can be compromised, it would take work and risk on the part of the NSA – so it p…

I assume it's a well thought through and properly risk-assesed security/convenience tradeoff. Handling encrypted files is much less frequent than handling encrypted email - and putting an airgap between the internet and your email is likely to cause more grief than the security improvement it creates.

I've got the seeds of an idea which has been kicking round my head for a few weeks now - a rasbperrypi (or similar) with GPG installed on it, which is connected to my main computer as a usb device (possibly impersonating a usb keyboard). The 'pi could be sent encrypted data over the usb/serial connection, and send back the plaintext. The 'pi would have no network connection – reducing the attack surface for someone trying to extract my private key remotely to some exploit that'd work over a tightly constrained serial connection. Sort of like a RSA SecureID on steroids - here's a device with a "cryptographically secure secret", but instead of just displaying TOTP tokens, you can feed it encrypted data and have it send back cleartext (optionally with a keypad and PIN/passcode required, but it's not "secure" against physical access, so I'm probably not going to try and implement that...).

Re: Bruce Schneier has changed his PGP key to 4096 bits

#53

Post by alexeisadeski3 »

SwellJoe wrote: post #36
vabmit wrote: post #22

Earlier quoted context omitted.

There's no need for a quantum computer. Everyone should be using at least 4096bit RSA. 1024bit RSA keys can be factored with conventional non-specialized hardware (read: CPU's, not even GPU's) with GNFS. IMHO, 2048bit RSA keys can be factored by custom hardware that the NSA has developed. I posted my reasoning for this hypothesis in other hackernews threads. A very quick/terse run down of the main key points - 1) NSA…

"2. Al Qaeda uses 2048bit RSA for internal communications 3. Most corps, diplomats, criminals, and normal people use 2048bit RSA either directly (SSH keys, Website Certs, VPNs) or indirectly (CA's still use 2048bit RSA certs valid until 2020)" I don't see how this is evidence that NSA has the ability to compromise 2048 bit keys, at will. Only that they very likely desire that ability. Math doesn't respond to desire.…

Given rumor of NSA crypto breakthroughs and fact massive expenditures, it's not unreasonable to believe they've compromised a primary target.

Re: Bruce Schneier has changed his PGP key to 4096 bits

#54

Post by jamesrom »

elliotanderson wrote: post #43

Bruce's article on staying secure from the NSA[1] talks about using an air gapped computer to avoid being compromised via the network. If he hadn't been keeping his keys on such a machine previously - recent disclosures may have changed his mind and forced him to regenerate his keys. [1] http://www.theguardian.com/world/2013/sep/05/nsa-how-to-rema...

I think this is the most likely reason.

Re: Bruce Schneier has changed his PGP key to 4096 bits

#55

Post by bigiain »

m0nastic wrote: post #44
miloshadzic wrote: post #32

Earlier quoted context omitted.

Does the reason for that ever come up in a conversation? I thought that everyone working in security used PGP a lot.

In a dozen years, I think I've had a grand total of 4 clients (out of several hundred) that ever used PGP (despite recommending it specifically on project kickoff calls, particularly for communicating discovered vulnerabilities). I only had one who already had a key. Outside of those few work examples, I don't think I've ever sent or received a PGP encrypted message. In fact, the only signed messages I think I've eve…

Since 1997, I've collected public keys from a grand total of 17 friends/colleagues/business-contacts.

(Note: FWIW, the email address in your profile doesn't provide a public key from pgp.mit.edu – I would have added you to my keychain and sent you a "Hi! Isn't it nice to introduce yourself without the NSA listening in!" email…)

Re: Bruce Schneier has changed his PGP key to 4096 bits

#56

Post by bigiain »

malandrew wrote: post #28
michiel3 wrote: post #25

In the post he also describes that he now uses a new process which involves a computer that has never been connected to the internet and its sole purpose is encrypting and decrypting files. Why not use it to encrypt and decrypt emails as well? That'd also potentially involve generating a new key pair. > 3) Assume that while your computer can be compromised, it would take work and risk on the part of the NSA – so it p…

With linux, is there any way to compromise the USB stick used for the air gap? AFAIK the Stuxnet virus was originally spread via USB stick, however I reckon that it involved Windows machines that are known to execute files on USB sticks.

If you aren't 100% sure of the providence of your usb stick, you can't really rely on it for _anything_ – have you seen Travis Goodspeed's "Writing a Thumbdrive from Scratch" presentation?

http://www.youtube.com/watch?v=D8Im0_KUEf8

Re: Bruce Schneier has changed his PGP key to 4096 bits

#57

Post by m0nastic »

bigiain wrote: post #55
m0nastic wrote: post #44

Earlier quoted context omitted.

In a dozen years, I think I've had a grand total of 4 clients (out of several hundred) that ever used PGP (despite recommending it specifically on project kickoff calls, particularly for communicating discovered vulnerabilities). I only had one who already had a key. Outside of those few work examples, I don't think I've ever sent or received a PGP encrypted message. In fact, the only signed messages I think I've eve…

Since 1997, I've collected public keys from a grand total of 17 friends/colleagues/business-contacts. (Note: FWIW, the email address in your profile doesn't provide a public key from pgp.mit.edu – I would have added you to my keychain and sent you a "Hi! Isn't it nice to introduce yourself without the NSA listening in!" email…)

I just searched pgp.mit.edu and it looks like the first key I have on there is from 1998[1] (with several others from previous jobs, although I don't know why I had two keys when I worked at BBN).

I don't think I even have a key for my current email address.

[1] http://pgp.mit.edu:11371/pks/lookup?op=vindex&search=0x867C6...

Re: Bruce Schneier has changed his PGP key to 4096 bits

#58

Post by smoyer »

bigiain wrote: post #52
michiel3 wrote: post #25

In the post he also describes that he now uses a new process which involves a computer that has never been connected to the internet and its sole purpose is encrypting and decrypting files. Why not use it to encrypt and decrypt emails as well? That'd also potentially involve generating a new key pair. > 3) Assume that while your computer can be compromised, it would take work and risk on the part of the NSA – so it p…

I assume it's a well thought through and properly risk-assesed security/convenience tradeoff. Handling encrypted files is much less frequent than handling encrypted email - and putting an airgap between the internet and your email is likely to cause more grief than the security improvement it creates. I've got the seeds of an idea which has been kicking round my head for a few weeks now - a rasbperrypi (or similar) w…

If you have to store encrypted credit card data, that's the recommended way of keeping it safe. Your Pi is analogous to hardware encryption devices that have been available for some time.

Re: Bruce Schneier has changed his PGP key to 4096 bits

#59

Post by aroch »

drdaeman wrote: post #51
SwellJoe wrote: post #36

Earlier quoted context omitted.

"2. Al Qaeda uses 2048bit RSA for internal communications 3. Most corps, diplomats, criminals, and normal people use 2048bit RSA either directly (SSH keys, Website Certs, VPNs) or indirectly (CA's still use 2048bit RSA certs valid until 2020)" I don't see how this is evidence that NSA has the ability to compromise 2048 bit keys, at will. Only that they very likely desire that ability. Math doesn't respond to desire.…

> normal people use 2048bit RSA either directly (SSH keys, Website Certs, VPNs) Any reason for that? [Almost] all of my SSH and TLS (be it HTTPS or OpenVPN) keys are 4096 bits long. I wasn't woried about TLAs with supercomputers snooping on my wires, just heard that 4096 bit RSA keys are considered more secure than 2048 while not sacrificing performance much, so I just didn't have the reason to specify lower size.

    Any reason for that?
OpenSSL's default keylength is 2048? ssh-keygen uses 2048 by default.

Re: Bruce Schneier has changed his PGP key to 4096 bits

#60

Post by kyboren »

bigiain wrote: post #52
michiel3 wrote: post #25

In the post he also describes that he now uses a new process which involves a computer that has never been connected to the internet and its sole purpose is encrypting and decrypting files. Why not use it to encrypt and decrypt emails as well? That'd also potentially involve generating a new key pair. > 3) Assume that while your computer can be compromised, it would take work and risk on the part of the NSA – so it p…

I assume it's a well thought through and properly risk-assesed security/convenience tradeoff. Handling encrypted files is much less frequent than handling encrypted email - and putting an airgap between the internet and your email is likely to cause more grief than the security improvement it creates. I've got the seeds of an idea which has been kicking round my head for a few weeks now - a rasbperrypi (or similar) w…

That definitely fits with the 'hacker ethos' and all, but why not just use a smartcard with a Class III reader (i.e. dedicated pinpad and display on the reader itself).

Support is already integrated with GnuPG, they are specifically designed to prevent key material leaking, and they have some other nice properties (like self-destruction after three incorrect admin PIN attempts).

Smartcards are cheap, anyway: http://shop.kernelconcepts.de/product_info.php?cPath=1_26&pr...

Post reply on HN