4 ms·

The fact that this works means that comparing keys visually by their artwork is insecure, since it allows you to generate a key pair which looks very similar to

by yccs27 2y ago

The fact that this works means that comparing keys visually by their artwork is insecure, since it allows you to generate a key pair which looks very similar to a target public key. I guess visual fingerprints might not have enough entropy.

tayiorrobinson 2y ago
It's probably still more secure than trying to compare the regular old string representations (who checks more than the last 5 characters from the end?) And plus, you still have to brute force it to get one that looks close
clysm 2y ago
Where's the proof that this works? It's a brute forcing tool with the goal of finding the desired fingerprint, but there's no demonstration of it actually working.
- tasuki 2y ago
  It's enough to find a fingerprint that's visually similar enough. It doesn't have to be exactly the same. That's many orders of magnitude easier than finding an exact match!
doctoboggan 2y ago
> and kill the artist when patience is depleted. This is the key part. You probably have to have _a lot_ of patience to get anything reasonable.
simlevesque 2y ago
> means that comparing keys visually by their artwork is insecure I'm not sure if this goal is achievable.
deleted 2y ago
[deleted]
dloss 2y ago
A very easy way to find such "visual" collisions is described in section 4.2 of our drunken bishop paper: http://www.dirk-loss.de/sshvis/drunken_bishop.pdf http://www.dirk-loss.de/sshvis/drunken_bishop.pdf
MitPitt 2y ago
Comparing visually wasn't safe in the first place for the same reason, this changes nothing
remram 2y ago
Here's my key's [1] art: +------[RSA]------+ | .+.+ oE+=oo | | .B.O.o=+B . | | o.O +*.o.= | | . = ++ = . . | | + +S. o . | | . *. . . | | o o | | . | | | +-----[SHA256]----+ After 10,000,000 iterations (150 hours CPU time or so), this is the closest I got: +------[RSA]------+ | o+*B*=+Bo | | o.+.*X=O o | | = +*+* o o | | E = += + o | | + =S . + | | o . . . | | . | | | | | +-----[SHA256]----+ [1]: https://github.com/remram44.keys https://github.com/remram44.keys

by yccs27 2y ago

tayiorrobinson 2y ago

It's probably still more secure than trying to compare the regular old string representations (who checks more than the last 5 characters from the end?) And plus, you still have to brute force it to get one that looks close

clysm 2y ago

Where's the proof that this works? It's a brute forcing tool with the goal of finding the desired fingerprint, but there's no demonstration of it actually working.

tasuki 2y ago
It's enough to find a fingerprint that's visually similar enough. It doesn't have to be exactly the same. That's many orders of magnitude easier than finding an exact match!

doctoboggan 2y ago

> and kill the artist when patience is depleted. This is the key part. You probably have to have _a lot_ of patience to get anything reasonable.

simlevesque 2y ago

> means that comparing keys visually by their artwork is insecure I'm not sure if this goal is achievable.

deleted 2y ago

[deleted]

dloss 2y ago

A very easy way to find such "visual" collisions is described in section 4.2 of our drunken bishop paper: http://www.dirk-loss.de/sshvis/drunken_bishop.pdf http://www.dirk-loss.de/sshvis/drunken_bishop.pdf

MitPitt 2y ago

Comparing visually wasn't safe in the first place for the same reason, this changes nothing

remram 2y ago

Here's my key's [1] art: +------[RSA]------+ | .+.+ oE+=oo | | .B.O.o=+B . | | o.O +*.o.= | | . = ++ = . . | | + +S. o . | | . *. . . | | o o | | . | | | +-----[SHA256]----+ After 10,000,000 iterations (150 hours CPU time or so), this is the closest I got: +------[RSA]------+ | o+*B*=+Bo | | o.+.*X=O o | | = +*+* o o | | E = += + o | | + =S . + | | o . . . | | . | | | | | +-----[SHA256]----+ [1]: https://github.com/remram44.keys https://github.com/remram44.keys