5 ms·

I think we know very well which encryption has been foiled by the NSA. This is not speculation, but quasi-certainty: 1024-bit RSA. - Crytographers all acknowle

by mrb 13y ago

I think we know very well which encryption has been foiled by the NSA. This is not speculation, but quasi-certainty: 1024-bit RSA. - Crytographers all acknowledge 1024-bit RSA is dead [1]. - Attack cost 10 years ago was estimated to be a few million USD to build a device able to crack a 1024-bit key every 12 months [2]. - "Much of" the "secure" HTTPS websites use such weak key sizes [3]. - NSA had a budget of 10.8 billion USD in 2013. Drawing a conclusion is not very hard. [1] http://arstechnica.com/uncategorized/2007/05/researchers-307-digit-key-crack-endangers-1024-bit-rsa/ http://arstechnica.com/uncategorized/2007/05/researchers-307... [2] http://www.cs.tau.ac.il/~tromer/twirl/ http://www.cs.tau.ac.il/~tromer/twirl/ [3] https://www.eff.org/pages/howto-using-ssl-observatory-cloud https://www.eff.org/pages/howto-using-ssl-observatory-cloud

leokun 13y ago
Some popular browsers still do not support newer versions. We tried turning this on with a newer, more secure key and ended up having downtime for some customers.
- trafficlight 13y ago
  Which browsers in particular?
  - leokun 13y ago
    Android Browser on Google TV, and Java libraries hitting our APIs. Google TV and Android browsers are critical to our business.
    - mrb 13y ago
      I have written lots of Java code accessing HTTPS sites with 2048 or 3072-bit RSA. This is perfectly supported. You do not even need the Unlimited Strength Jurisdiction Policy Files to use such RSA key sizes (other algorithms are restricted). I can't comment on Android Browser on Google TV, but I very highly doubt it fails to support 2048-bit RSA keys. If that was the case, half the HTTPS websites would be unbrowsable(!) [1] [1] Per the EFF SSL observatory dataset, roughly 1 in 2 websites uses key lengths strictly higher than 1024 bits.
      - leokun 13y ago
        We had downtime for this, so I am 100% sure. We isolated it to the key, and reverting the cert/key back to 1024 fixed it. It was just an option on GoDaddy one of the engineers picked to generate a 2048 cert. They only offer 1024 and 2048. One key worked, the other didn't.
        mrb 13y ago
        It must have been something else that broke it, not the key size. Android Browser definitely supports 2048-bit RSA certs. Maybe a root cert was absent from the browser (GoDaddy would be using a different root for 2048-bit certs?). Or maybe intermediate certs were missing in the certificate path. It sounds like your engineer did not spend much time trying to figure out what aspect of SSL/X.509 was actually causing the problem.
        leokun 13y ago
        There were no problems with accessing the site with Chrome or other modern browsers. What you described would have been a problem with all browsers, and anyway GoDaddy supplies all the files you need in a single zip file, including the intermediate certs. We did simply revert the SSL key, once we isolated that to be the problem. There is no pressing business need for a 2048-bit key.
        mrb 13y ago
        That is incorrect. Mobile browsers, the JVM, etc, notoriously lag behind desktop browsers when it comes to updating the list of root certs (and intermediate certs too, but that seems irrelevant in your case). The consequence is that a site can be accessed from the desktop, but not from a mobile. It was a recurrent problem at a previous job with a Java app accessing HTTPS sites. We could not always update the JVM (which comes with the most recent list of roots in "cacerts"), so we had to develop a solution to push the latest cacerts truststore to our application. Problem fixed. Do you know if Android Browser users reported at least an ability to click through an SSL warning to get to the site?
- mrb 13y ago
  Very unlikely. Virtually all browsers support 2048-bit RSA. Keys larger than 2048 bits, however, are not always supported (which is probably what you tried).
aliston 13y ago
The article you linked to in [1] doesn't explicitly say that generalized 1024-bit RSA is dead. They found a way to exploit a special case key (Mersenne number keys). Searching around the internet, I found a bunch of articles about supposed cracks, but they all involved additional sources of information. I'm not doubting that the NSA has found ways to crack all sorts of crypto, but is there really a known way to break 1024-bit RSA without other special qualifiers?
- mrb 13y ago
  When asked whether 1024-bit RSA keys are dead, Lenstra said: "The answer to that question is an unqualified yes." Generalized 1024-bit RSA keys are dead. Lenstra is making a comment on generalized 1024-bit RSA keys in this sentence. Not on Mersenne number factorization (which is, yes, the main topic of this article). My link [2] tells you concretely how to break 1024-bit RSA and estimates the cost to $10M, well within NSA's capabilities.
Achshar 13y ago
I am confused. When I see HN or facebook certs they show 128 bit encryption in the browser box. 128 bit seems pretty low.
- mpyne 13y ago
  128 talks about symmetric key encryption, not RSA. I'm not sure what the crypto best practice is regarding key strength for 128 bit for symmetric crypto, but presumably it would depend on the cipher used.
- F30 13y ago
  This is the size of the AES key. AES is a symmetric algorithm and 128 bit are still considered solid there, although the trend is moving towards 256 bit. What we're talking about here is the key size of RSA, which is an asymmetric algorithm. If you don't know the difference, go find a basic crypto tutorial. As you can read above, 1024 bit RSA is probably borken. I wouldn't trust 2048 bit too much as well. Also, progress in breaking RSA is happening a lot faster than with AES. In the context of SSL, an assymetric algorithm like RSA is used to exchange symmetrc keys, which are used afterwards.
  - XorNot 13y ago
    That said, 256-bit isn't really that much of an improvement for AES - its favored since that's the US standard for Top Secret classification, but in practice any attack which brings down AES-128 will almost certainly get AES-256 as well. I've switched most of my SSH servers over to default to 128-bit AES ciphers since the difference in difficulty seems small enough that it won't matter if someone actually tries targeting it and can succeed.
- mcovey 13y ago
  Probably AES, not RSA. IIRC a 128-bit AES key is about equivalent in security to a 2048-bit RSA key.
  - caf 13y ago
    2048 bit RSA is usually described as roughly equivalent in security margin to a 112 bit symmetric key, and 3072 bit RSA to be 128 bit symmetric equivalent.
masswerk 13y ago
Considering http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ I wouldn't bet on "deep encryption" either ...
- einhverfr 13y ago
  There are two very different questions: 1. What are the chances that crypto will keep the NSA out of your communications generally? and 2. What are the chances that crypto will keep the NSA out of your communications if they really, really want to read them? Those questions are very different. I wonder, for example, of what would happen if all internet traffic was encrypted end to end with something as weak as DES. Could the NSA brute force it? Of course. Could they brute force all of it? doubtful. One of the clear in-between-the-lines things in the article is that crypto is still problematic to the point where the NSA prefers to attack endpoints and get access that way instead of attacking the crypto itself.

by mrb 13y ago

leokun 13y ago

Some popular browsers still do not support newer versions. We tried turning this on with a newer, more secure key and ended up having downtime for some customers.

trafficlight 13y ago
Which browsers in particular?
- leokun 13y ago
  Android Browser on Google TV, and Java libraries hitting our APIs. Google TV and Android browsers are critical to our business.
  - mrb 13y ago
    I have written lots of Java code accessing HTTPS sites with 2048 or 3072-bit RSA. This is perfectly supported. You do not even need the Unlimited Strength Jurisdiction Policy Files to use such RSA key sizes (other algorithms are restricted). I can't comment on Android Browser on Google TV, but I very highly doubt it fails to support 2048-bit RSA keys. If that was the case, half the HTTPS websites would be unbrowsable(!) [1] [1] Per the EFF SSL observatory dataset, roughly 1 in 2 websites uses key lengths strictly higher than 1024 bits.
    - leokun 13y ago
      We had downtime for this, so I am 100% sure. We isolated it to the key, and reverting the cert/key back to 1024 fixed it. It was just an option on GoDaddy one of the engineers picked to generate a 2048 cert. They only offer 1024 and 2048. One key worked, the other didn't.
      - mrb 13y ago
        It must have been something else that broke it, not the key size. Android Browser definitely supports 2048-bit RSA certs. Maybe a root cert was absent from the browser (GoDaddy would be using a different root for 2048-bit certs?). Or maybe intermediate certs were missing in the certificate path. It sounds like your engineer did not spend much time trying to figure out what aspect of SSL/X.509 was actually causing the problem.
        leokun 13y ago
        There were no problems with accessing the site with Chrome or other modern browsers. What you described would have been a problem with all browsers, and anyway GoDaddy supplies all the files you need in a single zip file, including the intermediate certs. We did simply revert the SSL key, once we isolated that to be the problem. There is no pressing business need for a 2048-bit key.
        mrb 13y ago
        That is incorrect. Mobile browsers, the JVM, etc, notoriously lag behind desktop browsers when it comes to updating the list of root certs (and intermediate certs too, but that seems irrelevant in your case). The consequence is that a site can be accessed from the desktop, but not from a mobile. It was a recurrent problem at a previous job with a Java app accessing HTTPS sites. We could not always update the JVM (which comes with the most recent list of roots in "cacerts"), so we had to develop a solution to push the latest cacerts truststore to our application. Problem fixed. Do you know if Android Browser users reported at least an ability to click through an SSL warning to get to the site?
mrb 13y ago
Very unlikely. Virtually all browsers support 2048-bit RSA. Keys larger than 2048 bits, however, are not always supported (which is probably what you tried).

aliston 13y ago

The article you linked to in [1] doesn't explicitly say that generalized 1024-bit RSA is dead. They found a way to exploit a special case key (Mersenne number keys). Searching around the internet, I found a bunch of articles about supposed cracks, but they all involved additional sources of information. I'm not doubting that the NSA has found ways to crack all sorts of crypto, but is there really a known way to break 1024-bit RSA without other special qualifiers?

mrb 13y ago
When asked whether 1024-bit RSA keys are dead, Lenstra said: "The answer to that question is an unqualified yes." Generalized 1024-bit RSA keys are dead. Lenstra is making a comment on generalized 1024-bit RSA keys in this sentence. Not on Mersenne number factorization (which is, yes, the main topic of this article). My link [2] tells you concretely how to break 1024-bit RSA and estimates the cost to $10M, well within NSA's capabilities.

Achshar 13y ago

I am confused. When I see HN or facebook certs they show 128 bit encryption in the browser box. 128 bit seems pretty low.

mpyne 13y ago
128 talks about symmetric key encryption, not RSA. I'm not sure what the crypto best practice is regarding key strength for 128 bit for symmetric crypto, but presumably it would depend on the cipher used.
F30 13y ago
This is the size of the AES key. AES is a symmetric algorithm and 128 bit are still considered solid there, although the trend is moving towards 256 bit. What we're talking about here is the key size of RSA, which is an asymmetric algorithm. If you don't know the difference, go find a basic crypto tutorial. As you can read above, 1024 bit RSA is probably borken. I wouldn't trust 2048 bit too much as well. Also, progress in breaking RSA is happening a lot faster than with AES. In the context of SSL, an assymetric algorithm like RSA is used to exchange symmetrc keys, which are used afterwards.
- XorNot 13y ago
  That said, 256-bit isn't really that much of an improvement for AES - its favored since that's the US standard for Top Secret classification, but in practice any attack which brings down AES-128 will almost certainly get AES-256 as well. I've switched most of my SSH servers over to default to 128-bit AES ciphers since the difference in difficulty seems small enough that it won't matter if someone actually tries targeting it and can succeed.
mcovey 13y ago
Probably AES, not RSA. IIRC a 128-bit AES key is about equivalent in security to a 2048-bit RSA key.
- caf 13y ago
  2048 bit RSA is usually described as roughly equivalent in security margin to a 112 bit symmetric key, and 3072 bit RSA to be 128 bit symmetric equivalent.

masswerk 13y ago

Considering http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ http://www.wired.com/threatlevel/2012/03/ff_nsadatacenter/ I wouldn't bet on "deep encryption" either ...

einhverfr 13y ago
There are two very different questions: 1. What are the chances that crypto will keep the NSA out of your communications generally? and 2. What are the chances that crypto will keep the NSA out of your communications if they really, really want to read them? Those questions are very different. I wonder, for example, of what would happen if all internet traffic was encrypted end to end with something as weak as DES. Could the NSA brute force it? Of course. Could they brute force all of it? doubtful. One of the clear in-between-the-lines things in the article is that crypto is still problematic to the point where the NSA prefers to attack endpoints and get access that way instead of attacking the crypto itself.