NSA's Backdoor Key from Lotus Notes
cypherspace.org
NSA's Backdoor Key from Lotus Notes
1–10 of 55 posts
Re: NSA's Backdoor Key from Lotus Notes
#2Notice they used only 760 bit RSA and it only has to be factored once. Then you can brute force the remaining 40-bit keyspace with GPUs.
Re: NSA's Backdoor Key from Lotus Notes
#3There was also a key marked as 'NSAKEY' in a normally encrypted part of Windows NT that was revealed in a Service Pack. However Microsoft said it had another purpose.
Re: NSA's Backdoor Key from Lotus Notes
#4There was also a key marked as 'NSAKEY' in a normally encrypted part of Windows NT that was revealed in a Service Pack. However Microsoft said it had another purpose. http://en.m.wikipedia.org/wiki/NSAKEY
Anyone have a list of software that the NSA has backdoored?
http://en.wikipedia.org/wiki/NSAKEY
It'd be nice to have a single wikipedia page of all the software.
Re: NSA's Backdoor Key from Lotus Notes
#5Notice they used only 760 bit RSA and it only has to be factored once. Then you can brute force the remaining 40-bit keyspace with GPUs.
I don't know much about crypto. This is bad I assume?
Re: NSA's Backdoor Key from Lotus Notes
#6Notice they used only 760 bit RSA and it only has to be factored once. Then you can brute force the remaining 40-bit keyspace with GPUs.
I don't know much about crypto. This is bad I assume?
It is stronger than the 512-bit RSA factored in the FREAK attack but is still factorable with clusters. I wonder how fast a FPGA would be able to do it.
Re: NSA's Backdoor Key from Lotus Notes
#7From Ray Ozzie himself in a previous discussion:
Re: NSA's Backdoor Key from Lotus Notes
#8Notice they used only 760 bit RSA and it only has to be factored once. Then you can brute force the remaining 40-bit keyspace with GPUs.
I don't know much about crypto. This is bad I assume?
RSA-768 has been factored by academics in 2009[0].
It has long been speculated that NSA can factor 1024bit RSA (or DHE) using custom hardware, which is why in protocols like TLS and SSH the current recommendation is for keys, certificates and Diffie Hellman key exchange to be at least as strong as RSA-2048 (e.g. 256 bit elliptic curve crypto is strong enough).
Re: NSA's Backdoor Key from Lotus Notes
#9From Ray Ozzie himself in a previous discussion: https://news.ycombinator.com/item?id=5846189
This is an amazing thread, just want to make sure people in this one know.
Re: NSA's Backdoor Key from Lotus Notes
#10Earlier quoted context omitted.
I don't know much about crypto. This is bad I assume?
It is stronger than the 512-bit RSA factored in the FREAK attack but is still factorable with clusters. I wonder how fast a FPGA would be able to do it.
FPGA are very very inefficient at doing anything, they are very flexible and you can program them to perform specific operations very quickly relative to general purpose hardware however most of the silicon is dedicated to facilitate the programmability of the FPGA rather than the actual processing.
If you only have access to commodity hardware than GPU's would probably be better. Xeon Phi is also insanely cheap right now and you can get a 57 core card for under or just about 200$ but I don't have clear performance data for it, i know for BC mining it's comparable to R9 290/295X or so but with much lower power consumption, but i also suspect that due to its relative low market cap it's fairly poorly optimized atm.
NSA and large private organizations use most likely specially designed hardware rather than commodity hardware and surely not FPGAs.
For private individuals the most cost effective way to factor a single key these days is probably renting EC2 GPU instances (CUDA) from Amazon @ about 70 cents and hour you should be able to factor 512bit keys for 75-150$ (based on confirmed reports). 1024 bit might also be in reach however it will require a sizable budget.
Based on the current development of "auxiliary" processing components whether it's GPU based compute cards or more traditional but highly threaded processing cards ala Xeon Phi it would not surprised me if 1024 or even 2048 bit keys will be easy to factor before 2020. My current bet is that 1024 will be achievable on EC2 or a similar service by late 2016 to mid 2017. NIST has disallowed 1024bit since 2014, and based on it's previous deprecation most keys were factored within 2 years after it's final deprecation notice.
It's also quite important to point that there are quite a bit of "weak" RSA keys out there and there's a good chance that the NSA and similar organizations have the capability to factor certain keys probably upto and including 2048 bit.