4 ms·

My big picture take-away is: It seems that the NSA (and possibly other state-level actors) can access encrypted traffic that uses 1024-bit Diffie-Hellman that

My big picture take-away is: It seems that the NSA (and possibly other state-level actors) can access encrypted traffic that uses 1024-bit Diffie-Hellman that use commonly-used prime numbers. This means HTTPS, SSH, IPsec, SMTPS, and protocols that rely on TLS are potentially vulnerable. Where’s there’s smoke, there’s fire and there’s a lot of smoke indicating the NSA can do this. They have the money, technology, infrastructure and the technical ability to pull this off. From https://weakdh.org https://weakdh.org: >Breaking the single, most common 1024-bit prime used by web servers would allow passive eavesdropping on connections to 18% of the Top 1 Million HTTPS domains. A second prime would allow passive decryption of connections to 66% of VPN servers and 26% of SSH servers. A close reading of published NSA leaks shows that the agency’s attacks on VPNs are consistent with having achieved such a break. This is real. It’s all of the networking infrastructure that no longer gets software/firmware updates running 512, 768 and 1024-bit Diffie-Hellman that are likely already being exploited, not to mention all of the old VPNs, email servers, SSH clients, etc. that can’t be easily upgraded and can’t use more secure encryption protocols. After all of the hoopla dies down, this is the ongoing problem. But don’t panic. On current operating systems, going to larger 2048-bit Diffie-Hellman or using Elliptic-Curve Diffie-Hellman Key Exchange (ECDH) addressed the problem. As has been pointed out several times, 2048-bit Diffie-Hellman isn’t double the strenght of 1024-bit Diffie-Hellman; we’re going from a keyspace of 2^1024 to 2^2048. So unless there’s an unprecedented crytography breakthrough or quantum computers start sprouting like Dandelions, 2048-bit Diffie-Hellman is firmly in the "it would take more energy than what would be required to boil all of the oceans on Earth" arena. If you’re going the ECDHE route, everyone agrees that the NIST curves are suspect and that Curve25519: http://cr.yp.to/ecdh.html http://cr.yp.to/ecdh.html is what you want. More at SafeCurves: http://safecurves.cr.yp.to http://safecurves.cr.yp.to. If you keep up with current cryptography trends, you’re probably already in a good place, but it doesn’t hurt to check. There are lots of guides on how to get your stuff right: * Secure Secure Shell: https://stribika.github.io/2015/01/04/secure-secure-shell.html https://stribika.github.io/2015/01/04/secure-secure-shell.ht... * Mozilla's Security/Guidelines/OpenSSH: https://wiki.mozilla.org/Security/Guidelines/OpenSSH https://wiki.mozilla.org/Security/Guidelines/OpenSSH * Guide to Deploying Diffie-Hellman for TLS: https://weakdh.org/sysadmin.html https://weakdh.org/sysadmin.html * Qualys SSL Server Test: https://www.ssllabs.com/ssltest/index.html https://www.ssllabs.com/ssltest/index.html

PlzSnow 11y ago
"It seems that the NSA (and possibly other state-level actors) can access encrypted traffic that uses 1024-bit Diffie-Hellman that use commonly-used prime numbers." How does it "seem this"? There's no evidence, no plausibility, no sense here whatsoever. Someone hypothetically conjectured a magic all-powerful computer that could magically crack a prime, and that would magically make us all vulnerable to the government who want to steal the data from my recipe startup and the church newsletters documents on my laptop. And therefore, system admins are all recommending upgrading to 2048 keys? I can't see the sense or logic here. It just seems hysterical conspiracy nonsense to me.
- schoen 11y ago
  It seems like you're calling section 4.1 of the paper "magical"; do you have something specific in it to object to that makes you think the estimates are severely mistaken? In order to defend against adversaries with undisclosed capabilities, you have to extrapolate known attack methods and hardware to produce estimates of what may be practical. Every paper that proposes keylength and parameter size recommendations does this. If we didn't extrapolate this way, there would have been no reason to stop using 56-bit symmetric ciphers until 1998 (!). The hardware necessary to crack such a cipher could have been dismissed as "magical" because nobody who had built it had published a paper about it.
  - PlzSnow 11y ago
    It is magical. There is a magic 36000-core (?) computer that has been running for years (?). Well no, the paper just invents it. On the hearsay that an "anonymous nsa official" said they'd cracked something. It astonishes me that people are running about like rabbits in a headlight on such flimsy nonsense. But I understand. It makes us feel important. The new James Bond movie is coming out. And imagine! We're like a superhero secret agent. We can protect from the big bad government by increasing all the keys to 2048 bits! And we get to feel special and important. Sigh.
    - schoen 11y ago

PlzSnow 11y ago

"It seems that the NSA (and possibly other state-level actors) can access encrypted traffic that uses 1024-bit Diffie-Hellman that use commonly-used prime numbers." How does it "seem this"? There's no evidence, no plausibility, no sense here whatsoever. Someone hypothetically conjectured a magic all-powerful computer that could magically crack a prime, and that would magically make us all vulnerable to the government who want to steal the data from my recipe startup and the church newsletters documents on my laptop. And therefore, system admins are all recommending upgrading to 2048 keys? I can't see the sense or logic here. It just seems hysterical conspiracy nonsense to me.

schoen 11y ago
It seems like you're calling section 4.1 of the paper "magical"; do you have something specific in it to object to that makes you think the estimates are severely mistaken? In order to defend against adversaries with undisclosed capabilities, you have to extrapolate known attack methods and hardware to produce estimates of what may be practical. Every paper that proposes keylength and parameter size recommendations does this. If we didn't extrapolate this way, there would have been no reason to stop using 56-bit symmetric ciphers until 1998 (!). The hardware necessary to crack such a cipher could have been dismissed as "magical" because nobody who had built it had published a paper about it.
- PlzSnow 11y ago
  It is magical. There is a magic 36000-core (?) computer that has been running for years (?). Well no, the paper just invents it. On the hearsay that an "anonymous nsa official" said they'd cracked something. It astonishes me that people are running about like rabbits in a headlight on such flimsy nonsense. But I understand. It makes us feel important. The new James Bond movie is coming out. And imagine! We're like a superhero secret agent. We can protect from the big bad government by increasing all the keys to 2048 bits! And we get to feel special and important. Sigh.
  - schoen 11y ago