6 ms·
This describes research published in 2012 by Arjen Lenstra et al. (https://eprint.iacr.org/2012/064.pdf https://eprint.iacr.org/2012/064.pdf), which relied on a
by schoen 8y ago
This describes research published in 2012 by Arjen Lenstra et al. (https://eprint.iacr.org/2012/064.pdf https://eprint.iacr.org/2012/064.pdf), which relied on a scalable n-way GCD algorithm that Lenstra's team thought best not to explain to readers (in the hope that the attack wouldn't be quickly replicated for malicious purposes). Coincidentally, another team (Nadia Heninger et al., https://factorable.net/ https://factorable.net/) published extremely similar research in a similar timeframe, without withholding details of that team's GCD calculation approach.
The Heninger et al. paper explains quite a lot about where the underlying problems came from, most often inadequately seeded PRNGs in embedded devices. As the linked article mentions, other subsequent papers have also analyzed variants of this technique and so there's not much secret left about it.
If people are interested in learning about the impact of common factors on the security of RSA, I created a puzzle based on this which you can try out, which also includes an explanation of the issue for programmers who are less familiar with the mathematical context: http://www.loyalty.org/~schoen/rsa/ http://www.loyalty.org/~schoen/rsa/
Notably, my puzzle uses a small set of keys so you can do "easy" pairwise GCD calculations rather than needing an efficient n-way algorithm as described here (which becomes increasingly relevant as the number of keys in question grows).
- ikeyany 8y agoI attempted to do your puzzle but the link was blocked by my employer's firewall: > URL: http://www.loyalty.org/~schoen/rsa/ http://www.loyalty.org/~schoen/rsa/ > Block reason: Violence/Hate/Racism So... what exactly is loyalty.org all about?
- gtsteve 8y agoIt appears to be a personal website; I believe it is miscategorised.
- inciampati 8y agoI really doubt that shoen's page is any issue. Perhaps you can get to it in the way back machine.
- semi-extrinsic 8y agoMy experience with these firewalls/blacklists is that they have quite a few random false positives. Requests for fixing them one-by-one seems to be a recurring theme on our company chat.
- michaelmrose 8y agoOn a personal device it's reasonable to use a VPN.
- acct1771 8y agoOn a personal device, it's reasonable to use LTE.
- michaelmrose 8y agoNot always feasible. Not everyone has a cash to spend on data and lives in an area with good wireless coverage.
- semi-extrinsic 8y agoIt might be the case that some people employ VPN, or SOCKS proxies over ssh to their home computer, or similar schemes. I wouldn't know.
- ndnxhs 8y agoI would leave a company that used an internet blocker. They constantly get in the way of real work and benefit no one. The only valid use case I see is attempting to stop idiots downloading malware and installing it on company computers
- semi-extrinsic 8y agoIn more "traditional" companies that have software dev departments, they are extremely common in my experience, so switching companies wouldn't help much if you're in such a field. If 90% of the company employees only use IE and MS Word and are actually likely to install malware, and the last 10% are software engineers/data analysts/numerical simulation people, the latter are gonna have to work within/around these types of constraints.
- casefields 8y ago"www.loyalty.org itself is the server for the web site of Californians for Academic Freedom, the group I founded to oppose the California loyalty oath, which is still a non-negotiable requirement for anyone who wants to work for the State of California -- including student employees of the University of California. " http://www.loyalty.org/~schoen/ http://www.loyalty.org/~schoen/ That's the most controversial thing about the page. In my view it's not a big deal to have that stance but some people don't like others who rock the boat when it comes to the status quo.
- schoen 8y agoMy activism on this issue for the past decade and a half has basically consisted of corresponding for a few minutes each year with some new person who objects to signing the loyalty oath. I doubt that the site blocking has anything to do with this.
- wlll 8y agoI was curious about the contents and contentions points of the oath so went looking and one of the files you link to is a 404: http://www.loyalty.org/oath.txt http://www.loyalty.org/oath.txt
- cogburnd02 8y agohttp://web.archive.org/web/20000831114425/http://www.loyalty.org:80/oath.txt http://web.archive.org/web/20000831114425/http://www.loyalty...
- xkcd-sucks 8y agoCatch-22 should be required reading cf. "The great loyalty oath crusade"
- schoen 8y agoI don't know why my web site was categorized that way by your employer's firewall.
- KwanEsq 8y agoMaybe a particularly simplistic auto-categoriser mistook the few eighty-eights (88s) on the root page[0] for their use as Nazi symbolism[1]? [0] http://www.loyalty.org/ http://www.loyalty.org/ [1] https://en.wikipedia.org/w/index.php?title=88_(number)&oldid=876466778#In_white_nationalism https://en.wikipedia.org/w/index.php?title=88_(number)&oldid...
- kragen 8y agoFor context, Seth Schoen is not only very tolerant, one of the least racist USAns I know, but also Jewish.
- dunham 8y agoI'm guessing it's a false positive from using an IP similar to a sketchy site. It looks like the IP points to Linode. For what it's worth, I enjoyed the puzzle when I completed it three years ago. A practical exercise cracking the RSA keys followed by a small classic code breaking puzzle.
- croh 8y agomine too interesting. which firewall do your employer use ? here it is sonicwall.
- lurkertroll 8y agoThis website does a great job explaining how encryption works and how it's vulnerable to bad RNGs. Well done.
- swish_bob 8y agoNice puzzle. Feels like a good exercise for stretching the brain.