15 ms·
Can this bug cause invalid or easily breakable private keys?
by 0x0 11y ago
Can this bug cause invalid or easily breakable private keys?
- cperciva 11y agoI certainly wouldn't be surprised.
- tptacek 11y agoI would be. How un-surprised would you be? Enough to bet?
- cperciva 11y agoNot without looking at the code first. But the first thing which comes to mind is accidentally generating RSA primes which aren't prime because the broken multiplication makes a SPSP test accidentally pass. Granted, finding a concrete example would probably be very difficult, considering that replacing modexp by rand() is only going to pass N as a suspected prime with probability 1/N; but the question was can it, not will anyone ever find an example.
- ecesena 11y agoNot private key in public-key schemes (RSA, DH), because these are generally random integer and BN_mod_exp is not used in private key generation -- but it's used in public key generation so the result could be an invalid key pair. In addition, I think it could produce a wrong symmetric key, as a result of a bad computation e.g. in the Diffie-Hellman protocol. So you could have insecure symmetric (e.g., AES) keys.