4 ms·
What practical things can be done once RSA is broken?
by greggarious 4y ago
What practical things can be done once RSA is broken?
- quotemstr 4y agoDecrypt decades of pre-PFS archived encrypted internet traffic.
- retrocryptid 4y agoIf only someone archived it in a data center in the desert.
- greggarious 4y ago>> Decrypt decades of pre-PFS archived encrypted internet traffic. > If only someone archived it in a data center in the desert. Uh oh https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center Good think I declared moral bankruptcy this year, all that is the old me :-)
- nunez 4y agoisn't most stuff elliptic curve now?
- bawolff 4y agoBreaking RSA is a practical thing. E.g. forge email (most dkim keys are 1024 bit rsa). Break ssh (depends on key algo chose). Break pgp (depending on settings). Mitm https connections, Etc.
- greggarious 4y agoSo if you were going to explain it to someone who's less technical, maybe saying "remove HTTPS" would be an oversimplified way to explain? (I don't think my contacts aren't going to know what SSH or PGP is, if that helps.)
- deleted 4y ago[deleted]
- tialaramex 4y agoNot exactly. For the vast majority of HTTPS (say, for example, Google or Hacker News) RSA is not used to agree the encryption. So although quantum computers would be a threat for other reasons, breaking RSA in particular doesn't just "remove HTTPS". However, RSA is used to prove the identity of the server for most web sites even with a newer key agreement. So if an adversary can get on path between you and the server, they could get in the middle and masquerade successfully as the server - arranging key agreement with you, and then providing a convincing fake proof of identity, if they do so live. In TLS 1.2 optionally, and to a greater extent in older versions (which are no longer used by popular web browsers) you can also use RSA to agree the encryption, and for sites using that breaking RSA would allow an adversary to interpose in real time, or to decrypt communication after the fact, but I'd be astonished if anywhere important still does that when talking a halfway modern browser.
- bawolff 4y agoThe way id explain it to a non-technical person - it would (among other things) allow the person running the sketchy wifi at the coffee shop to see all the sites you are visiting and any data you enter.