5 ms·

Rotating keys works for authentication, but not for confidentiality, since nothing stops an attacker from recording the ciphertext and decrypting past messages.

• PeterisP 6y ago
  In common practice RSA keys/certificates are used for TLS and similar protocols where it does not allow to decrypt past recorded communications, as those are encrypted with an ephemeral session keys that can not be determined from observing the handshake even if you have the keys. Obtaining a private key would allow you to MITM future sessions and decrypt them, but it would not break confidentiality of past messages. Things like PGP-encrypted email files would be vulnerable, but that niche is extremely rare in comparison to other uses of RSA and similar encryption.
  • hannob 6y ago
    That's not how this works. An attacker can record the key exchange. That is not using RSA, today it's usually some variation of elliptic curve diffie hellman. But that is just as vulnerable to quantum attacks as RSA. So you're attacking the key exchange, not the RSA signature. What you're probably alluding to here is the forward secrecy property of TLS. But that is only true under the assumption that the key exchange is secure. In a quantum attack scenario it is not. So a store-and-decrypt-later attack is still a very valid concern around TLS and quantum computers.
    • PeterisP 6y ago
      Interesting, I had assumed that the whole purpose of Diffie-Hellman and the like is to ensure that the ephemeral keys which are generated during the process can't be recovered from recorded traffic even if you later find out the private keys used by the parties. Or is it the case that it's secure from just knowing the private keys, but efficient factorization e.g. Shor's algorithm can break the whole process?
      • CodesInChaos 6y ago
        The server holds the private key associated with the certificate for a long time. If you don't use ephemeral keys that means that compromising the sever (hacking, subpoena, etc) that will allow an attacker to decrypt any session they recorded which used that long term key. If you use ephemeral keys, the attacker needs to learn the ephemeral private key instead of the long term private key to decrypt the session. The server throws away the ephemeral private key (plus the symmetric session key) after a short time. So a later compromise of the server will not allow an attacker to decrypt old sessions. An attacker who can break the underlying cryptography on the other hand can still break the ephemeral keys used for the connection, since they (unavoidably) learn the public key from the handshake. It might increase cost, because they need to break each connection separately, but at that point the security margin is terribly thin.
    • monocasa 6y ago
      Diffie hellman is on the table to be cracked too by quantum computers, just as much as RSA.
  • bloak 6y ago
    But those ephemeral session keys can not be determined from observing the handshake because the handshake uses asymmetric cryptographic algorithms which may use exactly the same mathematics as RSA.
• UncleMeat 6y ago
  RSA is rarely actually used for doing the message encryption. Instead it is used for negotiating other keys. Perfect-forward-secrecy enables you to get message confidentiality even if your key is leaked after the message is sent.
  • CodesInChaos 6y ago
    Diffie-Hellman over finite fields or elliptic curves is just as vulnerable to Shor's algorithm as RSA. I believe ECC might even need fewer qubits to break at the same classical security level, since the numbers are smaller. There is a small benefit, because now an attacker needs to attack each session separately, instead of attacking a single key to break all sessions with a particular sever. But that's hardly something you want to rely on.
  • xucheng 6y ago
    Perfect-forward-secrecy relies on that you didn’t break the underlying cryptography primitives, which is not true with QC.
• grumple 6y ago
  Do these attacks take the same amount of time for one round of encryption vs multiple?