4 ms·

If you follow the links, you'll end up here: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/svenda https://www.usenix.org/co

If you follow the links, you'll end up here: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/svenda https://www.usenix.org/conference/usenixsecurity16/technical... Can bits of an RSA public key leak information about design and implementation choices such as the prime generation algorithm? We analysed over 60 million freshly generated key pairs from 22 open- and closedsource libraries and from 16 different smartcards, revealing significant leakage. The bias introduced by different choices is sufficiently large to classify a probable library or smartcard with high accuracy based only on the values of public keys. Such a classification can be used to decrease the anonymity set of users of anonymous mailers or operators of linked Tor hidden services, to quickly detect keys from the same vulnerable library or to verify a claim of use of secure hardware by a remote party.

lolc 10y ago
I found the original page hard to read. Reading the abstract of the paper cleared all the confusion.
- Animats 10y ago
  Right. The paper is much better than the PR. It's not clear there's a real security problem here in being able to identify the prime generator for RSA keys. Unless that generator is weaker than it should be. They did find at least two key generators which look suspicious. One generator never generates certain byte combinations, which indicates a possible serious weakness in the random number generation. Weak RSA key generators have been found in the past. Big flap back in 2012.[1] Some keys were found which were products of two large primes where two keys shared the one factor. This is hugely unlikely statistically; the generator had to be defective. This isn't that bad. The real worry, of course, is a designed-in weakness in the random number generator, one that's not detectable by the usual statistical tests. [1] http://arstechnica.com/business/2012/02/crypto-shocker-four-of-every-1000-public-keys-provide-no-security/ http://arstechnica.com/business/2012/02/crypto-shocker-four-...
deleted 10y ago
[deleted]
nailer 10y ago
dang could we update the link? This is a much more solid source.
bahjoite 10y ago
> If you follow the links, you'll end up here: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/svenda https://www.usenix.org/conference/usenixsecurity16/technical... and just to add, the paper itself and a video of the author's presentation are available at this page.
dfc 10y ago
Allegedly there is an extended version of the paper here: http://crcs.cz/rsa http://crcs.cz/rsa But the site is not responding and archive.org has no information either.

lolc 10y ago

I found the original page hard to read. Reading the abstract of the paper cleared all the confusion.

Animats 10y ago
Right. The paper is much better than the PR. It's not clear there's a real security problem here in being able to identify the prime generator for RSA keys. Unless that generator is weaker than it should be. They did find at least two key generators which look suspicious. One generator never generates certain byte combinations, which indicates a possible serious weakness in the random number generation. Weak RSA key generators have been found in the past. Big flap back in 2012.[1] Some keys were found which were products of two large primes where two keys shared the one factor. This is hugely unlikely statistically; the generator had to be defective. This isn't that bad. The real worry, of course, is a designed-in weakness in the random number generator, one that's not detectable by the usual statistical tests. [1] http://arstechnica.com/business/2012/02/crypto-shocker-four-of-every-1000-public-keys-provide-no-security/ http://arstechnica.com/business/2012/02/crypto-shocker-four-...

deleted 10y ago

[deleted]

nailer 10y ago

dang could we update the link? This is a much more solid source.

bahjoite 10y ago

> If you follow the links, you'll end up here: https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/svenda https://www.usenix.org/conference/usenixsecurity16/technical... and just to add, the paper itself and a video of the author's presentation are available at this page.

dfc 10y ago

Allegedly there is an extended version of the paper here: http://crcs.cz/rsa http://crcs.cz/rsa But the site is not responding and archive.org has no information either.