4 ms·
I'm pretty sure UnoriginalGuy understands that. What he says is correct, the attackers now have the private key file so all that prevents them from decrypting t
by corford 14y ago
I'm pretty sure UnoriginalGuy understands that. What he says is correct, the attackers now have the private key file so all that prevents them from decrypting the CC data is the passphrase. They don't know what this is but they can try and brute force it which is why it's relevant to wonder what cipher the key uses, how many bits and how long, random and complicated the passphrase text is.
Hopefully, they used 4096 bits and a random >20 char string as the passphrase. That combined with a standard cipher algorithm (DSA, RSA) should be enough to keep us safe.
- darkarmani 14y ago> What he says is correct, the attackers now have the private key file I will concede that this is highly likely, but they did not confirm that the private key was taken.
- UnoriginalGuy 14y agoIt is implied that it was taken. The IRC log said that they had taken it and since Linode is talking about the passphrase in their blog post, the implication there is that it was taken too. If the bad guys didn't have the private key then the passphrase is literally irrelevant to the discussion. Since they would have to break the primary cryptographic key rather than just the passphrase. A passphrase protects a private key file NOT the data. So why would Linode even bring it up?
- darkarmani 14y ago> A passphrase protects a private key file NOT the data. So why would Linode even bring it up? I would bring it when discussing how I cryptographically secured sensitive data. Especially, when people might be confused and try to argue that they should have used pbkdf2 and not encrypted the information (because they were thinking about password hashes).
- ryan-c 14y agoCracking even a 1024 bit RSA key would cost at least millions of dollars. Credit card numbers are not worth that much.
- ig1 14y agoTens of thousands of credit and debit cards, many of which are likely to be corporate cards with extremely high spending limits ?
- dangrossman 14y agoWorth no more than $1 a card on the black market. It'd be cheaper to buy cards than to try to crack the key. There's more supply than demand for stolen card numbers.
- ig1 14y agoThat's because the black market for credit cards is a lemon market [1] - known good corporate cards are much more valuable. [1] https://en.wikipedia.org/wiki/The_Market_for_Lemons https://en.wikipedia.org/wiki/The_Market_for_Lemons
- scott_karana 14y agoNobody needs to crack the key: merely the keyphrase. Bruteforcing is relatively cheap.