N.S.A. Foils Much Internet Encryption

Post by Zoepfli » Fri, Sep 06, 2013, 1:35 AM UTC

lambda wrote: post #198

magicalist wrote: post #150

Earlier quoted context omitted.

Was that really a seriously considered plan? I don't see how that would ever be a suitable /dev/random replacement. Obviously it works for /dev/urandom, but it should be added to the entropy pool for /dev/random at most.

Matt Mackall, the former maintainer of /dev/random, actually stepped down over this issue, because Linus overrode Matt and applied Intel's patch that used their hardware random number generator directly: http://comments.gmane.org/gmane.comp.security.cryptography.r... > It's worth noting that the maintainer of record (me) for the Linux RNG quit the project about two years ago precisely because Linus decided to include…

Post by caf » Fri, Sep 06, 2013, 1:48 AM UTC

mcovey wrote: post #270

Achshar wrote: post #258

Earlier quoted context omitted.

I am confused. When I see HN or facebook certs they show 128 bit encryption in the browser box. 128 bit seems pretty low.

Probably AES, not RSA. IIRC a 128-bit AES key is about equivalent in security to a 2048-bit RSA key.

Post by wfunction » Fri, Sep 06, 2013, 2:00 AM UTC

mindslight wrote: post #257

tptacek wrote: post #111

Earlier quoted context omitted.

This is almost definitely not "one of the vulnerabilities" implicated in the story today, because nobody uses CSPRNGs based on Elliptic Curve.

A RNG that is reducible to a different believed-hard problem has possible features, so it's not like there could never be a reason for someone to choose this generator. What we could be seeing is the discovery of one failed attempt of a shotgun approach to promulgate insecure primitives. It's hard to know what will happen to become commercially successful, so spray and pray. Something this blatant does seem like a se…

Post by TheCondor » Fri, Sep 06, 2013, 2:14 AM UTC

tptacek wrote: post #126

tc wrote: post #68

This is really damaging. Not only will this cause other countries to put up barriers against US (and UK) services and products, it's going to affect uptake of standards developed here. On the lighter side, a treasure hunt was just announced. Can you find one of these vulnerabilities, or evidence of the NSA having attacked a particular system to steal keys? ---- [Edit 1] Some speculation: By careful hardware design --…

I would not be at all surprised to learn that the major advance these disclosures refer to is an on-demand RSA-1024 factoring capability. RSA-1024 is already known to be unsafe (Eran Tromer estimates a 7 figure cost for a dedicated hardware cracker, which is approximately the threshold DES was at in the late '90s, when nobody believed DES was secure). On-demand offline RSA-1024 attacks would have major implications,…

Post by ballard » Fri, Sep 06, 2013, 2:22 AM UTC

TheCondor wrote: post #327

tptacek wrote: post #126

Earlier quoted context omitted.

I would not be at all surprised to learn that the major advance these disclosures refer to is an on-demand RSA-1024 factoring capability. RSA-1024 is already known to be unsafe (Eran Tromer estimates a 7 figure cost for a dedicated hardware cracker, which is approximately the threshold DES was at in the late '90s, when nobody believed DES was secure). On-demand offline RSA-1024 attacks would have major implications,…

That makes sense. I think it unlikely they've discovered an actual break through. They do have their own fab, how many chips do you need to build to Mae that worthwhile? It's the US government after all, a machine with 10million specialized RSA chips doesn't seem impossibly difficult, just expensive.