4 ms·

Many people mentioned that the Estonian ID card is vulnerable. I have an e-residency card, so I tried it out on https://keychest.net/roca https://keychest.net/r

by imrehg 9y ago

Many people mentioned that the Estonian ID card is vulnerable. I have an e-residency card, so I tried it out on https://keychest.net/roca https://keychest.net/roca If I use "pkcs15-tool --read-ssh-key 1" to read out the public key, (in the "ssh-rsa AAAAB3Nza....." format), then I get a vulnerable key warning (2048bit SSH key). On the other hand, if I use "pkcs15-tool --read-ssh-key 1 --rfc4716" to output in "---- BEGIN SSH2 PUBLIC KEY ----...." format, then it shows different key tests and tells me it's "safe key". Is this a weakness of the test, or is there really some difference between the "regular" and the "RFC4716 formatted key (I wouldn't expect that)? What am I missing? EDIT: using the standalone "roca-detect" (note, Python2 is required), then the first format reports potential vulnerability, while running it on the second format results in "Exception in processing PGP rec file estonia1.asc: Incorrect padding". So I guess it is indeed that the tool does not handle RFC4716 formatted SSH keys correctly?

runeks 9y ago
I’m no expert, but a serialization format cannot change any inherent properties about the key in question. It’s just a matter of how it’s presented. The key is the same (vulnerable or not). Can anyone tell me if using 3072 bit keys would have made a difference? Everywhere I look, 3072 bit RSA/256 bit ECDSA/256 bit hash functions/128 bit AES (=128 bits of security) seems to be the standard. Why choose 2048 bit keys for a national ID card?
- mcpherrinm 9y ago
  I'm not sure where you're looking but around my parts, 1024, 2048, 4096 bit RSA is most common. Most of those are 2048 bit. I can't think of a 3072 bit RSA key I've run into in the wild. That's usually TLS, GPG, SSH keys.
- baby 9y ago
  Check www.keylength.com, 3072-bit RSA keys are useless.
jf 9y ago
I wrote a tool to convert between all of the RSA key formats that I could find: http://github.com/jpf/lokey http://github.com/jpf/lokey If you're still curious if the key material is different (I'm very curious), try the following and compare the results: pkcs15-tool --read-ssh-key 1 | lokey to jwk pkcs15-tool --read-ssh-key 1 --rfc4716 | lokey to jwk (You can also replace "jwk" with any of the other supported RSA types. It might be easier to compare the "ssh" type)

by imrehg 9y ago

runeks 9y ago

I’m no expert, but a serialization format cannot change any inherent properties about the key in question. It’s just a matter of how it’s presented. The key is the same (vulnerable or not). Can anyone tell me if using 3072 bit keys would have made a difference? Everywhere I look, 3072 bit RSA/256 bit ECDSA/256 bit hash functions/128 bit AES (=128 bits of security) seems to be the standard. Why choose 2048 bit keys for a national ID card?

mcpherrinm 9y ago
I'm not sure where you're looking but around my parts, 1024, 2048, 4096 bit RSA is most common. Most of those are 2048 bit. I can't think of a 3072 bit RSA key I've run into in the wild. That's usually TLS, GPG, SSH keys.
baby 9y ago
Check www.keylength.com, 3072-bit RSA keys are useless.

jf 9y ago

I wrote a tool to convert between all of the RSA key formats that I could find: http://github.com/jpf/lokey http://github.com/jpf/lokey If you're still curious if the key material is different (I'm very curious), try the following and compare the results: pkcs15-tool --read-ssh-key 1 | lokey to jwk pkcs15-tool --read-ssh-key 1 --rfc4716 | lokey to jwk (You can also replace "jwk" with any of the other supported RSA types. It might be easier to compare the "ssh" type)