3 ms·
No, because there's a simple solution to state actors doing massive computations: make the parameters so large (2048 bits in the case of DH) that the computatio
by agwa 10y ago
No, because there's a simple solution to state actors doing massive computations: make the parameters so large (2048 bits in the case of DH) that the computations are infeasible.
DH precomputation attacks are only a problem with smaller prime sizes (e.g. 1024 bits). Experts have always known to avoid small parameters, but developers copy-and-pasted them into their code without knowing they were bad.
- Laforet 10y agoThis is kind of parallels what happened with MD5 fingerprints in X509 certificates: for years the writing was on the wall that MD5 collision was imminent with better algorithm and more computing power, yet it took a number of practical exploits by individual researchers to convince the industry that MD5 has to go away. One good thing to have come out of it was that we really learned about the importance to future proof our crypto and the phase-out of SHA1 was carried out a lot more elegantly. Similarly, it is expected now that state level actors can already break 1024 bit RSA and 128 bit symmetric ciphers may be the next thing to fall. Hence their use should be avoided wherever possible.
- javajosh 10y agoThat's a very good point, but I don't think it invalidates the "biodiversity" argument. It's a different kind of defense, but it is a defense. For example, if there is a breakthrough in prime factorization, then heterogenous implementations may be the only security left to us.