3 ms·

> When e = 3, or a similarly small number, many things can go wrong. Low public exponents often combine with other common mistakes to either allow an attacker t

> When e = 3, or a similarly small number, many things can go wrong. Low public exponents often combine with other common mistakes to either allow an attacker to decrypt specific ciphertexts or factor N. For instance, the Franklin-Reiter attack allows a malicious party to decrypt two messages that are related by a known, fixed distance. Surely anyone who studied a single textbook about crypto knows this? Or anyone who bothered to do a bit of reading about the crypto library they are using? After a bit of searching, apparently this is a big issue. Search for "RSA.gen_key" on any of the following pages: Exhibit A:https://github.com/const586/freestream/blob/ee95c78e85719caad9f2f421b60a100aa463a0a1/freestream/Core/LiveSourceAuthConfig.py https://github.com/const586/freestream/blob/ee95c78e85719caa... Exhibit B:https://github.com/lixmgl/Intern_OpenStack_Swift/blob/40c241319c6b9a7aabacc9d927486864d13b8055/trunk/salt/salt/crypt.py https://github.com/lixmgl/Intern_OpenStack_Swift/blob/40c241... Exhibit C:https://github.com/egbertbouman/tribler-g/blob/14e5c4eaf66f50d5ea54aa8f30ddc8a4a2017504/Tribler/Core/LiveSourceAuthConfig.py https://github.com/egbertbouman/tribler-g/blob/14e5c4eaf66f5... Exhibit D:https://github.com/wizzard/dm-p2player/blob/fb3a89aedc0a23741875c454468db9c2fb84e147/Tribler/Core/LiveSourceAuthConfig.py https://github.com/wizzard/dm-p2player/blob/fb3a89aedc0a2374... Exhibit E:https://github.com/mimianddaniel/booksalt/blob/248c2349fd9a6edc30d48d11673ab72bed4583ce/salt/crypt.py https://github.com/mimianddaniel/booksalt/blob/248c2349fd9a6... Exhibit F:https://github.com/GrandPaRPi/p2ptv-pi/blob/6f79c00f9055a3763ddfe1dc41e14d2cb533f4c3/acestream/ACEStream/Core/LiveSourceAuthConfig.py https://github.com/GrandPaRPi/p2ptv-pi/blob/6f79c00f9055a376... Exhibit G:https://github.com/C6SUMMER/allinclusive-kodi-pi/blob/8baf247c79526849c640c6e56ca57a708a65bd11/.kodi/userdata/addon_data/plugin.video.p2p-streams/acestream/ace/ACEStream/Core/LiveSourceAuthConfig.py https://github.com/C6SUMMER/allinclusive-kodi-pi/blob/8baf24...

djsumdog 7y ago
Ugh, and they're all using M2Crypto, which is terrible and broken anyway. I had huge issues with encrypting things with it and being able to decrypt or verify signatures with other libraries. I switched to PyPi RSA. It took a little bit of digging, but it seems to use a sane exponent by default: https://github.com/sybrenstuvel/python-rsa/blob/11bf33264c620684fcae6c248df30c0a444babdf/rsa/key.py#L48 https://github.com/sybrenstuvel/python-rsa/blob/11bf33264c62...
- lvh 7y ago
  There's a reason we're telling you to use libsodium box instead: even if pyrsa sets a reasonable exponent, for example, it's still a separate pure Python implementation (with fewer eyeballs and almost certainly more side channel vulnerabilities), and still uses PKCSv15, exposing you to Bb98-style padding oracle attacks.

djsumdog 7y ago

Ugh, and they're all using M2Crypto, which is terrible and broken anyway. I had huge issues with encrypting things with it and being able to decrypt or verify signatures with other libraries. I switched to PyPi RSA. It took a little bit of digging, but it seems to use a sane exponent by default: https://github.com/sybrenstuvel/python-rsa/blob/11bf33264c620684fcae6c248df30c0a444babdf/rsa/key.py#L48 https://github.com/sybrenstuvel/python-rsa/blob/11bf33264c62...

lvh 7y ago
There's a reason we're telling you to use libsodium box instead: even if pyrsa sets a reasonable exponent, for example, it's still a separate pure Python implementation (with fewer eyeballs and almost certainly more side channel vulnerabilities), and still uses PKCSv15, exposing you to Bb98-style padding oracle attacks.