5 ms·

Not generating good random numbers is not a huge concern for something like AES, where there's just such a large search space. But with RSA, generating a "bad

by daeken 14y ago

Not generating good random numbers is not a huge concern for something like AES, where there's just such a large search space. But with RSA, generating a "bad prime" is the difference between something taking until the death of the sun to break, and taking days. Edit: To clarify, primes for RSA keys are generated probabilistically -- we don't really know that they're prime, we just have a fair amount of confidence to that effect. It's entirely possible to generate bad 'primes' that really aren't prime at all, which makes factoring the keys trivial.

onli 14y ago
Thanks for the answer. But I don't understand that. For generating the prime-numbers used, you basically guess a number and use the miller-rabin-test or something like that to test if prim. Maybe you have a better approach, but generally, that should be equally possible using JS as any other language. You never want to implement something like this yourself for a real product, of course, but i don't see that specific issue. They even could build upon something like jsbn[1] I thought that this is about a missing random number generator. [1]http://www-cs-students.stanford.edu/~tjw/jsbn/ http://www-cs-students.stanford.edu/~tjw/jsbn/
- daeken 14y ago
  I am not a crytographer (by any means!), but my understanding from conversations with folks in that space is that it's very possible for a bad PRNG to generate primes that pass the standard tests but are still very breakable. I really don't have any more information than that; I should read up more there. Either way, that's by no means the biggest issue here -- some browsers already have CSPRNGs -- but rather that the code is coming from their server and is considered to be compromised by default. Browser-side crypto without very strict security boundaries on key generation and access is just bad news.
tptacek 14y ago
WAT? Bad random numbers are fatal to AES. Attacks against "AES" with a bad RNG don't attack the whole AES keyspace; they attack the bad RNG; in effect, implementing AES with a bad RNG reduces the security of the system to that of the RNG.

by daeken 14y ago

onli 14y ago

Thanks for the answer. But I don't understand that. For generating the prime-numbers used, you basically guess a number and use the miller-rabin-test or something like that to test if prim. Maybe you have a better approach, but generally, that should be equally possible using JS as any other language. You never want to implement something like this yourself for a real product, of course, but i don't see that specific issue. They even could build upon something like jsbn[1] I thought that this is about a missing random number generator. [1]http://www-cs-students.stanford.edu/~tjw/jsbn/ http://www-cs-students.stanford.edu/~tjw/jsbn/

daeken 14y ago
I am not a crytographer (by any means!), but my understanding from conversations with folks in that space is that it's very possible for a bad PRNG to generate primes that pass the standard tests but are still very breakable. I really don't have any more information than that; I should read up more there. Either way, that's by no means the biggest issue here -- some browsers already have CSPRNGs -- but rather that the code is coming from their server and is considered to be compromised by default. Browser-side crypto without very strict security boundaries on key generation and access is just bad news.

tptacek 14y ago

WAT? Bad random numbers are fatal to AES. Attacks against "AES" with a bad RNG don't attack the whole AES keyspace; they attack the bad RNG; in effect, implementing AES with a bad RNG reduces the security of the system to that of the RNG.