4 ms·
The $80k figure comes from the PR of the gov agency (RIA) responsible for the ID card infra. I'd take it with a grain of salt. The affected Estonian ID cards u
by tauntz 9y ago
The $80k figure comes from the PR of the gov agency (RIA) responsible for the ID card infra. I'd take it with a grain of salt.
The affected Estonian ID cards use 2048-bit RSA keys. If you look at the Ars Technica link then they are quoted:
the worst case for a 2048-bit one would require no more than 17 days and $40,300 using a 1,000-instance machine on Amazon Web Service ... On average, it would require half the cost and time to factorize the affected keys.
I assume this is calculated based on the standard EC2 prices ($40300/key with 17 days and 1k machines). If you'd use EC2 spot instances (or the relevant Google or Microsoft services - or any other of the vastly cheaper alternatives) then the cost comes down to about €5k (and 8 days with 1k low-tier EC2 machines) for a single key pair (on average, worst case is 2x that much).
I'm not the one to judge if that's cheap or expensive enough to not worry about anybody ever breaking a key. I just have to point out that this key is equivalent to a real signature and documents signed with it (also cast votes etc) are legally binding. In case of a breached private key, there's no (known) way to prove if it was you who signed some documents or an attacker.
- nobodyorother 9y agoThe next obvious question is "whose signature is worth more than €5k a month (until the Smartcard is updated and the old sig is revoked)?"
- tauntz 9y agoAnybody who has assets worth more than €5k? And there's currently no publicly announced plan/date for revoking the affected certs. There's a tool coming out in November that you can use to generate new certs for your own ID card but as it's not compulsory, don't expect 100% of affected people to update in a matter of days, weeks or months.
- AdamJacobMuller 9y agoAren't these cards in Estonia used for a LOT of things, like banking access? EG: at 50k it's probably not profitable to do this per-user but at 5k it is probably VERY profitable if you could get enough public keys.
- iofiiiiiiiii 9y agoEven a single ID card can be valuable - factor a big company CEO's private key, log in to his company's bank, start making transfers to places where the money does not come back from.
- vacri 9y ago> or any other of the vastly cheaper alternatives On how many of these vastly cheaper alternatives is it possible to simply spin up a fleet of a thousand machines?
- tauntz 9y agoYou are correct. I stated it as a fact whereas I was just assuming there are vastly cheaper alternatives to AWS to do such nefarious things such as renting machines in a botnet, using dedicated HW that you might have anyway around for coin mining etc.