3 ms·

I would go a step further and say that “sealed” implies they somehow changed something that directly impacts all RSA encryption. At least that’s the way I read

I would go a step further and say that “sealed” implies they somehow changed something that directly impacts all RSA encryption. At least that’s the way I read it. Almost like taking down a botnet by taking over the domain or IP it’s C&C server uses. The reality was far less movie plot worthy.

segfaultbuserr 8y ago
> “sealed” implies they somehow changed something that directly impacts all RSA encryption. So we are talking about holes in RSA, some readers may find the following interesting, that in fact, RSA does have a problematic aspect (well, many) that can be called a "loophole": the padding. You are encrypting a short message (the symmetric key) by using a large public key, so the message have to be padded. From now the real fun started, intuitive solutions are prone to various forms of mathematical and cryptographic tricks, you get chosen ciphertext attack, and gives an attacker a straightforward "padding oracle". If you can manipulate the ciphertext and asks the server if the ciphertext is valid (or not), often, the attacker can deduce knowledge of the message or even the private key. Bleichenbacher attack and Coppersmith attack are known in the 90s, yet we still see exploitations in 2015. Proper padding is tricky to design and implement. As a response to this problem, OAEP, a padding algorithm with rigorous security proof, has finally been designed, and it should put an end to these attacks eventually. Yet, recently there have been some theoretical doubts about the soundness of the proof. But it turns out, you don't have to encrypt the session key as a message and padding it securely to begin with. Cryptographer Victor Shoup purposed RSA-KEM. The basic idea is, we can just keep generating a stream of meaningless random numbers using a CSPRNG, until it's long enough to be encrypted by the public key. Then, put these random numbers to a hash function (or any other secure KDF), the output will be the session key. This scheme is known as RSA-KEM, offers strong security guarantee, yet it only uses a simple approach that is hard to get wrong. https://en.wikipedia.org/wiki/Key_encapsulation https://en.wikipedia.org/wiki/Key_encapsulation

segfaultbuserr 8y ago

> “sealed” implies they somehow changed something that directly impacts all RSA encryption. So we are talking about holes in RSA, some readers may find the following interesting, that in fact, RSA does have a problematic aspect (well, many) that can be called a "loophole": the padding. You are encrypting a short message (the symmetric key) by using a large public key, so the message have to be padded. From now the real fun started, intuitive solutions are prone to various forms of mathematical and cryptographic tricks, you get chosen ciphertext attack, and gives an attacker a straightforward "padding oracle". If you can manipulate the ciphertext and asks the server if the ciphertext is valid (or not), often, the attacker can deduce knowledge of the message or even the private key. Bleichenbacher attack and Coppersmith attack are known in the 90s, yet we still see exploitations in 2015. Proper padding is tricky to design and implement. As a response to this problem, OAEP, a padding algorithm with rigorous security proof, has finally been designed, and it should put an end to these attacks eventually. Yet, recently there have been some theoretical doubts about the soundness of the proof. But it turns out, you don't have to encrypt the session key as a message and padding it securely to begin with. Cryptographer Victor Shoup purposed RSA-KEM. The basic idea is, we can just keep generating a stream of meaningless random numbers using a CSPRNG, until it's long enough to be encrypted by the public key. Then, put these random numbers to a hash function (or any other secure KDF), the output will be the session key. This scheme is known as RSA-KEM, offers strong security guarantee, yet it only uses a simple approach that is hard to get wrong. https://en.wikipedia.org/wiki/Key_encapsulation https://en.wikipedia.org/wiki/Key_encapsulation