5 ms·
If RSA-2048 is practically broken or breakable: The public web and code signing PKIs collapse overnight. Most certificate authorities use RSA-2048 either for t
by tgsovlerkhgsel 6y ago
If RSA-2048 is practically broken or breakable:
The public web and code signing PKIs collapse overnight. Most certificate authorities use RSA-2048 either for the roots or intermediates. The HN site not only uses a RSA-2048 key in its own certificate, the CA issuing that certificate and the root CA issuing the intermediate also do.
All data transmitted without forward secrecy on most web sites is compromised. Most websites nowadays use forward secrecy and/or ECDSA, but data sent years ago may still be of value (e.g. passwords) and become decryptable now.
Any data (e.g. backups, past e-mails) encrypted using RSA keys is at risk.
Any authentication system relying on RSA keys has a problem. This can include systems like smartcards or HSMs that are hard to update, software or firmware updates, etc. Banking too.
Edit to add - if RSA-1024 is practically breakable but RSA-2048 is not: some systems that relied on RSA-1024 have a problem. These should be rare, but sometimes legacy doesn't get updated until it becomes an absolute emergency. Everyone realizes that RSA-2048 is only a matter of time, that time is running out quicker than expected, and starts upgrading to ECDSA with more urgency. This will likely take a long time due to legacy hardware.
- the8472 6y agoAlso any proprietary/ancient SSH implementation only supporting RSA that you'll find in all kinds of boxes.
- bigiain 6y agoSurely I'm not the only one who read this and thought "I wonder how long the NSA have known this result, and how much better their internal attacks are than public academic results? I wonder how much of their 'full take' internet backbone archive has been decrypted and keyword mined?"
- secfirstmd 6y agoThere was a quote in a newspaper I unfortunately forget the location of about four years ago about a massive break through in encryption by the NSA post Snowden. Enough subtle hints about it. My working assumption had been it was RSA related. I noticed for example some interesting organisations changed their guidelines about its usage in past three years or so.
- drzoltar 6y agoWhich organizations changed their guidelines?
- gowld 6y agoThis has been speculated since logjam was discovered.
- tgsovlerkhgsel 6y agoIf it is what I think it is, then it's commonly believed that they broke commonly used Diffie-Hellman parameters, allowing them to break any connection encrypted using those. The parameters can, in theory, be safely used by everyone, and generating them is relatively expensive. But because a few of these parameters were extremely widely used, and they were only 1024 bits strong, it is believed that a gargantuan effort to break them was worth it and the NSA did it.
- mekster 6y agoAre alternatives already available that needs to be swapped to be durable again?
- upofadown 6y ago>All data transmitted without forward secrecy on most web sites is compromised. Forward secrecy does not protect against broken cryptography, so this is more about what methods were used and how much an new technique like this affects them.
- lokedhs 6y agoTrue, but it does protect against broken RSA. Because RSA is a not used to encrypt the actual data. That's probably using AES.
- upofadown 6y agoIf you break RSA then you get the AES session key. You don't have to break the AES.
- jojobas 6y agoThe point of forward secrecy is that past key are not recoverable from future communications. You need to store the whole communication history to have any chance.
- upofadown 6y agoUnless you break the encryption. Then you get the past keys. Forward secrecy only protects against the exposure of private key material. It does not protect against broken cryptography as it depends on the cryptography to keep old messages private. That's because it works by forgetting the session keys. If you can derive those session keys again then it is of no value.
- jojobas 6y agoNope. A session key is normally not created by one party and sent to another, it's generated by something like Diffie-Hellman in which the long-living RSA keys are only used for authenticity verification. Diffie-Hellman requires discrete logarithms rather than factorization (and then there are more modern methods).