4 ms·
I always wonder if when things like this get found, there's someone in the NSA going "Wow they finally found it, only took them x years"
by swalsh 11y ago
I always wonder if when things like this get found, there's someone in the NSA going "Wow they finally found it, only took them x years"
- phkahler 11y ago>> I always wonder if when things like this get found, there's someone in the NSA going "Wow they finally found it, only took them x years" I would guess they were aware of the problem weather they created it or not. So yes.
- duaneb 11y ago> I would guess they were aware of the problem weather they created it or not. While it's smart to assume so, it's also pretty laughable to think that the NSA has an exhaustive list of encryption vulnerabilities.
- tankenmate 11y ago> While it's smart to assume so, it's also pretty laughable to think that the NSA has an exhaustive list of encryption vulnerabilities. True, but in this case I'm sure they have enough hardware to factor any widely deployed primes used in crypto or semi crypto comms software. After all, that is half of the NSAs job description.
- nisa 11y ago> it's also pretty laughable to think that the NSA has an exhaustive list of encryption vulnerabilities Why not? They have enough mathematicians and cryptographers on payroll that they can analyse the major protocols and software that is used. If you look at the recent attacks on TLS - especially the downgrade attacks to export grade ciphers they would be stupid to not exploit this for targeted attacks. That being said I doubt they'll have very good mathematical attacks as a lot of researchers look at this stuff but implementation bugs, side channel attacks and plain bugs are plenty. most of the world runs openssl or CryptoAPI - why not spend a few man years looking through these implementations? Well at least if I where them I'd have some programmers to come up with automatic bug finding techniques and fuzz the hell out of existing applications. They also likely don't care about your encrypted facebook chat but government infrastructure, mobile telecommunication providers and lots of important enterprises are probably pretty often on their "we need to get in list" if you can decrypt captured encrypted traffic - I imagine this would be a huge net win.
- duaneb 11y agoBecause coming up with an exhaustive list of all the encryption software in the world would be difficult, let alone enumerating all of their vulnerabilities.
- wolfgke 11y agoFor practical purposes it should suffice if they create an exhaustive list of the encryption software that is used, say, in 99% of all cases. Finding those and documenting some vulnerabilities of each is quite a realistic goal.
- duaneb 11y agoSure. This is also not exhaustive, by definition.
- jldugger 11y agoThe NSA is old enough, and well resourced enough. Time and money solve these problems readily enough. In the case of FOSS, all you really need is a parser designed to hunt down specific sorts of flaws. We have static analysis for non-crypto needs, it seems reasonable someone at NSA got funded to write one for their use case.
- gcommer 11y agoFWIW, this hardcoded "prime" was only in use since 2015 (though before that, it was 512 bits)