51–60 of 114 posts
Why should we wait for somebody else to run a few obvious algorithms on our own keys?
Anybody knows what to use and has a good recipe?
The goal should be, don't trust the program which generated the keys, extract them and run the independent tests. I guess a lot of people would gladly use some time for that.
Is there any way to get GPG to print out the two factors when the key is generated? 231 is absurd.
gpg --verbose --keyserver hkp://hkps.pool.sks-keyservers.net --recv-key 0xbda06085493bace4
gpg: requesting key 0xBDA06085493BACE4 from hkp server hkps.pool.sks-keyservers.net
gpg: armor header: Version: SKS 1.1.5
gpg: armor header: Comment: Hostname: keyserver.witopia.net
gpg: pub 4096R/0xBDA06085493BACE4 2011-09-22 H. Peter Anvin
gpg: key 0xBDA06085493BACE4: invalid subkey binding
gpg: key 0xBDA06085493BACE4: skipped subkey
gpg: key 0xBDA06085493BACE4: "H. Peter Anvin (hpa) " not changed
gpg: Total number processed: 1
gpg: unchanged: 1When I try to download any of the three stated fingerprints from keys.gnupg.net, I receive a key which is missing the vulnerable subkey (containing only the two non-vulnerable ones). That makes me worry that there may be an element of keyserver misbehavior in this story, though I don't understand the nature of the misbehavior.
Edit: agwa's post shows that my gpg is receiving the same thing from the keyservers that these folks had, but it's rejected it as invalid because it's missing a valid signature.
Earlier quoted context omitted.
https://eprint.iacr.org/2012/064.pdf https://factorable.net/weakkeys12.extended.pdf
Thanks. The first paper mentions some 157 PGP keys and some "probably copy-paste errors." Maybe somebody can tell more about it, I wasn't able to evaluate the effects. The second didn't analyze PGP keys, but otherwise was certainly impressive.
You shouldn't be surprised to see blatant lies from Mircea Popescu, who also claims that he's a billionare, that English literature literally does not exist, that bitcoin literally makes states and laws obsolete, and that nuclear weapons are ineffective.
Is this title misleading or linkbait? If so, we should change it as the HN guidelines ask. Would "Two pairs of RSA keys having a common factor found" do? Suggestions for an accurate, neutral title are always welcome.
Edit: We've detached this subthread as off-topic.
I know of RSA, but could someone break down this article a bit? Does this mean RSA is now broken and we must find a new algorithm?
RSA is not broken per se. (AFAIK) If you have a 4096-bit key, nobody is able to factor a 4096-number yet . However, using a bad random prime generator might lead to birthday attack when someone is using the same prime as you. Having two keys that share a prime, it is possible to factor both . Also, one of the "primes" used is 231, which is extremely stupid, its factors 3 7 11, so there are two keys that are using the…
When I try to import HPA's key from the public key servers, I get an "invalid subkey binding" error and the weak sub key isn't imported. That error means that the sub key isn't properly signed by HPA's master key, so there is no cryptographic proof that this weak sub key actually belongs to HPA. This looks more like a fake sub key that someone tried to pollute the public key servers with, which isn't really an issue…
If this is the explanation, then this is either an attack by a random person or an attack or flaw in a keyserver, but an attack that's unlikely to work because users will discard the bad key rather than using it.
Earlier quoted context omitted.
Exactly. The GPG that generated that keypair was obviously not doing what it was supposed to do. It can be something on the level of the famous Debian patch fiasco. The worrying thing is that nobody until now published such findings. The second found p is 21(!?) Edit: see the new post from agwa, if all the keys with bad properties came the same way it's much less worrying.
A look at the PGP ecosystem through the key server data https://eprint.iacr.org/2015/262.pdf
"Based on my research it seems that over a very long time the use of PGP implementations with deeply awed random number generation functions was very rare."