6 ms·

For something of this magnitude, I think the expected behavior would be to delay the release of the paper until the ecosystem had time to adapt. To prove the pa

For something of this magnitude, I think the expected behavior would be to delay the release of the paper until the ecosystem had time to adapt. To prove the paper is valid (and to assert precedence) you would offer to factor several "nothing up my sleeve" numbers -- like sha512("schnorr1") + sha512("schnorr2"). As it is, if the algorithm presented is valid then this potentially compromises currently operating systems.

dcow 6y ago
I do not agree that so-called “responsible disclosure” would or should be the expected behavior. I do understand how someone accustomed to corporate bug bounties and private security mailing lists may think so, though. Full disclosure is a perfectly reasonable strategy especially when we’re operating in the academic realm. Industry always takes years to catch up to academia anyway.
- nine_k 6y ago
  If this paper allows to produce a working RSA cracker in a month, much of high-value IT infrastructure is under imminent threat. Yes, you can replace your SSH keys with elliptic ones, and maybe adjust your TLS accepted algorithms. Even this is not always easy or cheap. But other things that may rely on RSA (or triple RSA) may have trouble upgrading fast, and upgrading them at all is going to cost a lot.
  - martamorena2843 6y ago
    Yeah, but also the industry knows for DECADES that RSA will likely be broken eventually. Not having reacted yet is not the researcher's fault. We know that Quantum computers can break it too, yet nobody really acts on it with any urgency. If suddenly there is a breakthrough and we can reach this state within a year, then there will be no time to adapt as well. It all boils down to the general corporate attitude of not fixing catastrophic problems without precedence. We see the same with climate change and once it hits hard, it will be too late to adapt.
    - upofadown 6y ago
      >Yeah, but also the industry knows for DECADES that RSA will likely be broken eventually. Interesting. Reference?
      - kadoban 6y ago
        It's generally accepted for almost all crypto protocols that it's going to be broken eventually (a few rare cases are provably secure, one-time pads and not much else). If nothing else, quantum computers should break RSA in particular (the algorithm is already known and just waiting for hardware) and the writing has been on the wall there for a long time.
        vbezhenar 6y ago
        > It's generally accepted for almost all crypto protocols that it's going to be broken eventually Just like it was generally accepted that god exists. Those claims are of similar strength. > If nothing else, quantum computers should break RSA in particular Quantum computers with enough qubits do not exist and it's absolutely not obvious whether they will exist at all.
        saagarjha 6y ago
        Cryptographically protocols have attacks designed against them all the time.
    - im3w1l 6y ago
      I asked a few years ago(I don't remember the specifics) what was the recommended post-quantum crypto, and basically the answer was that there wasn't any vetted and proven post-quantum crypto. So I don't think you can blame the industry here.
      - tialaramex 6y ago
        There are some promising experiments. All of them are much worse than the algorithms we use today (including RSA) in practical terms, except that Shor's algorithm doesn't apply to them, and so they specifically fulfil the criterion of post-quantum public key crypto. [For symmetric encryption quantum computers would only matter if they were pretty fast/cheap and we didn't have ready-to-go 256-bit symmetric crypto, but we do] OpenSSH actually has an implementation of a reasonable contender for SSH. Google have experimented (in Chrome builds) with some of these contenders for TLS too. What you would likely want to do - since by definition these are relatively untried algorithms and so might be unsafe against adversaries with an existing not-at-all-quantum computer - is combine with an existing algorithm, most likely elliptic curve based, but RSA would be possible, under a "swiss cheese" model where you're only dead if an adversary penetrates all the layers. But like I said, much worse. Given that there aren't any suitably large quantum computers (and it's always possible that we'll eventually figure out we just can't build usefully large quantum computers, just like we eventually found out that while you can travel faster than sound you can't travel faster than light) it would make no sense to deploy this today, even though it continues to make sense to do research Just In Case.
  - tialaramex 6y ago
    > triple RSA Yeah, no. 3DES (Triple DES) is/ was a thing, but Triple RSA is not.
    - eps 6y ago
      That was the joke.
  - AlexCoventry 6y ago
    > If this paper allows to produce a working RSA cracker in a month The blog post claims that people have been trying to reproduce his results for two years, though.
coliveira 6y ago
If you find something that can break all cryptography in the world, then I think your best option (even for your personal security) is to release everything publicly.
- deleted 6y ago
  [deleted]
- pacman2 6y ago
  A one time pad can not be broken.
  - ajarmst 6y ago
    I always enjoy the reaction when I tell students that we've had provably unbreakable encryption since the 19th century.
    - generalizations 6y ago
      And yet any time someone proposes to actually implement it, the response is always negative: "don't roll your own encryption" or "sharing and storing the pads is infeasible" or some such. Seems like we should have figured out a way by now to use one time pad encyption by default for critical paths, even if that requires new industries to distribute pads and guarantee their security.
      - ajarmst 6y ago
        Yeah. I take up the key exchange problem (and Diffie-Hellman) as well as difficulty of achieving true randomness.
        generalizations 6y ago
        I've made matlab scripts that pull true randomness out of the less-significant figures of the output of an audio microphone listening to static...it's not impossible. If we were serious about it, sharing flash drives and even using couriers could make it work pretty well.
deleted 6y ago
[deleted]
toast0 6y ago
I haven't read the paper or anything, but if the expected adaptation is to drop support for RSA; no reasonable amount of time will make it a seamless transition. There are so many devices and pieces of software that are stuck on RSA, a headsup of say 5 years would still result in a clossal mess; may as well have the mess now.
ajarmst 6y ago
Note that (despite the ill-considered claim about RSA in the abstract) this isn't security research. It's a maths paper in a very important area of number theory. It doesn't disclose a patchable flaw in RSA---it claims that RSA is based on an unproven conjecture that turns out to be false. That RSA is vulnerable to fast prime factoring has been known since it was first implemented. That's not fixable, so delay serves little purpose, especially with a (if it turns out to be true) seminal result in number theory.
GordonS 6y ago
RSA has published the same set of "come and break me" keys for years, decades I think. Breaking those public (in both senses!) keys would be a good start.

dcow 6y ago

I do not agree that so-called “responsible disclosure” would or should be the expected behavior. I do understand how someone accustomed to corporate bug bounties and private security mailing lists may think so, though. Full disclosure is a perfectly reasonable strategy especially when we’re operating in the academic realm. Industry always takes years to catch up to academia anyway.

nine_k 6y ago
If this paper allows to produce a working RSA cracker in a month, much of high-value IT infrastructure is under imminent threat. Yes, you can replace your SSH keys with elliptic ones, and maybe adjust your TLS accepted algorithms. Even this is not always easy or cheap. But other things that may rely on RSA (or triple RSA) may have trouble upgrading fast, and upgrading them at all is going to cost a lot.
- martamorena2843 6y ago
  Yeah, but also the industry knows for DECADES that RSA will likely be broken eventually. Not having reacted yet is not the researcher's fault. We know that Quantum computers can break it too, yet nobody really acts on it with any urgency. If suddenly there is a breakthrough and we can reach this state within a year, then there will be no time to adapt as well. It all boils down to the general corporate attitude of not fixing catastrophic problems without precedence. We see the same with climate change and once it hits hard, it will be too late to adapt.
  - upofadown 6y ago
    >Yeah, but also the industry knows for DECADES that RSA will likely be broken eventually. Interesting. Reference?
    - kadoban 6y ago
      It's generally accepted for almost all crypto protocols that it's going to be broken eventually (a few rare cases are provably secure, one-time pads and not much else). If nothing else, quantum computers should break RSA in particular (the algorithm is already known and just waiting for hardware) and the writing has been on the wall there for a long time.
      - vbezhenar 6y ago
        > It's generally accepted for almost all crypto protocols that it's going to be broken eventually Just like it was generally accepted that god exists. Those claims are of similar strength. > If nothing else, quantum computers should break RSA in particular Quantum computers with enough qubits do not exist and it's absolutely not obvious whether they will exist at all.
        saagarjha 6y ago
        Cryptographically protocols have attacks designed against them all the time.
  - im3w1l 6y ago
    I asked a few years ago(I don't remember the specifics) what was the recommended post-quantum crypto, and basically the answer was that there wasn't any vetted and proven post-quantum crypto. So I don't think you can blame the industry here.
    - tialaramex 6y ago
      There are some promising experiments. All of them are much worse than the algorithms we use today (including RSA) in practical terms, except that Shor's algorithm doesn't apply to them, and so they specifically fulfil the criterion of post-quantum public key crypto. [For symmetric encryption quantum computers would only matter if they were pretty fast/cheap and we didn't have ready-to-go 256-bit symmetric crypto, but we do] OpenSSH actually has an implementation of a reasonable contender for SSH. Google have experimented (in Chrome builds) with some of these contenders for TLS too. What you would likely want to do - since by definition these are relatively untried algorithms and so might be unsafe against adversaries with an existing not-at-all-quantum computer - is combine with an existing algorithm, most likely elliptic curve based, but RSA would be possible, under a "swiss cheese" model where you're only dead if an adversary penetrates all the layers. But like I said, much worse. Given that there aren't any suitably large quantum computers (and it's always possible that we'll eventually figure out we just can't build usefully large quantum computers, just like we eventually found out that while you can travel faster than sound you can't travel faster than light) it would make no sense to deploy this today, even though it continues to make sense to do research Just In Case.
- tialaramex 6y ago
  > triple RSA Yeah, no. 3DES (Triple DES) is/ was a thing, but Triple RSA is not.
  - eps 6y ago
    That was the joke.
- AlexCoventry 6y ago
  > If this paper allows to produce a working RSA cracker in a month The blog post claims that people have been trying to reproduce his results for two years, though.

coliveira 6y ago

If you find something that can break all cryptography in the world, then I think your best option (even for your personal security) is to release everything publicly.

deleted 6y ago
[deleted]
pacman2 6y ago
A one time pad can not be broken.
- ajarmst 6y ago
  I always enjoy the reaction when I tell students that we've had provably unbreakable encryption since the 19th century.
  - generalizations 6y ago
    And yet any time someone proposes to actually implement it, the response is always negative: "don't roll your own encryption" or "sharing and storing the pads is infeasible" or some such. Seems like we should have figured out a way by now to use one time pad encyption by default for critical paths, even if that requires new industries to distribute pads and guarantee their security.
    - ajarmst 6y ago
      Yeah. I take up the key exchange problem (and Diffie-Hellman) as well as difficulty of achieving true randomness.
      - generalizations 6y ago
        I've made matlab scripts that pull true randomness out of the less-significant figures of the output of an audio microphone listening to static...it's not impossible. If we were serious about it, sharing flash drives and even using couriers could make it work pretty well.

deleted 6y ago

[deleted]

toast0 6y ago

I haven't read the paper or anything, but if the expected adaptation is to drop support for RSA; no reasonable amount of time will make it a seamless transition. There are so many devices and pieces of software that are stuck on RSA, a headsup of say 5 years would still result in a clossal mess; may as well have the mess now.

ajarmst 6y ago

Note that (despite the ill-considered claim about RSA in the abstract) this isn't security research. It's a maths paper in a very important area of number theory. It doesn't disclose a patchable flaw in RSA---it claims that RSA is based on an unproven conjecture that turns out to be false. That RSA is vulnerable to fast prime factoring has been known since it was first implemented. That's not fixable, so delay serves little purpose, especially with a (if it turns out to be true) seminal result in number theory.

GordonS 6y ago

RSA has published the same set of "come and break me" keys for years, decades I think. Breaking those public (in both senses!) keys would be a good start.