5 ms·

64,081 is really close to 65536 (2^16) -- I wonder if the 64,000 vulnerable TLS keys have anything to do with a bug similar to the 2008 Debian SSL key fiasco, w

by gpcz 13y ago

64,081 is really close to 65536 (2^16) -- I wonder if the 64,000 vulnerable TLS keys have anything to do with a bug similar to the 2008 Debian SSL key fiasco, where the only contributor to the key's entropy was the PID (2^15 combinations). It would be interesting to see data about the types of devices that have these weak keys, but then again if there is a correlation its release could be used maliciously in the wild.

ye 13y ago
It's definitely a bug, most likely in the pre-prime generation (not enough entropy). If we're talking 1024-bit integers created by multiplying two 512-bit primes, the facts are: 1) The number of 512-bit primes is estimated around 11.36×10^150 2) The chance that two truly random primes are the same is one in 3.37*10^75. It is safe to assume it has never happened and never will (at least on our current hardware).
- jsmeaton 13y ago
  > We’re only at 10^7 so far. As Heninger said in her talk, we have enough 512-bit primes to assign a public encryption key to every atom in the universe, with little worry over possible duplicates. I find the scale of these numbers absolutely incredible.
kalleboo 13y ago
The post mentions "Most of them are found in embedded networked devices, such as routers and firewalls". Embedded devices like that have very little entropy on first boot - that could might cause them to generate very poor keys. I wonder how many of the 60% non-unique keys are embedded devices with hardcoded keys...
- voltagex_ 13y ago
  I can see the bumper stickers now - "Have you disassembled your firmware today?" Sigh. I'm not sure what we can do (as an industry). Bad devices (and bad firmware, and bad software) are so widely deployed it seems almost impossible to fix.
- bigiain 13y ago
  "I wonder how many of the 60% non-unique keys are embedded devices with hardcoded keys..." That wouldn't surprise me much at all. I've been working on a secure workaround to let an embedded webserver on our consumer-oriented wifi-equipped hardware(1) do OAuth2 authentication (to connect to owner's Twitter/Faceboot/et al. accounts). OAuth relies on SSL/TLS to protect it's password-equivalent tokens on-the-wire. Getting an SSL cert onto the device (at a reasonable cost) so that a phone connecting to it via wifi doesn't throw up big scarey "somebody might be doing _bad_ things!" warnings is not easily solved. (1) Shameless self promotion: http://holiday.moorescloud.com http://holiday.moorescloud.com - The world's most intelligent christmas lights…
reirob 13y ago
This question has been asked in the comments to the article and there is answer: "Heninger et al. did check their data for “Debian weak keys.” They found 4,147 such TLS keys and 53,141 SSH keys."

by gpcz 13y ago

ye 13y ago

It's definitely a bug, most likely in the pre-prime generation (not enough entropy). If we're talking 1024-bit integers created by multiplying two 512-bit primes, the facts are: 1) The number of 512-bit primes is estimated around 11.36×10^150 2) The chance that two truly random primes are the same is one in 3.37*10^75. It is safe to assume it has never happened and never will (at least on our current hardware).

jsmeaton 13y ago
> We’re only at 10^7 so far. As Heninger said in her talk, we have enough 512-bit primes to assign a public encryption key to every atom in the universe, with little worry over possible duplicates. I find the scale of these numbers absolutely incredible.

kalleboo 13y ago

The post mentions "Most of them are found in embedded networked devices, such as routers and firewalls". Embedded devices like that have very little entropy on first boot - that could might cause them to generate very poor keys. I wonder how many of the 60% non-unique keys are embedded devices with hardcoded keys...

voltagex_ 13y ago
I can see the bumper stickers now - "Have you disassembled your firmware today?" Sigh. I'm not sure what we can do (as an industry). Bad devices (and bad firmware, and bad software) are so widely deployed it seems almost impossible to fix.
bigiain 13y ago
"I wonder how many of the 60% non-unique keys are embedded devices with hardcoded keys..." That wouldn't surprise me much at all. I've been working on a secure workaround to let an embedded webserver on our consumer-oriented wifi-equipped hardware(1) do OAuth2 authentication (to connect to owner's Twitter/Faceboot/et al. accounts). OAuth relies on SSL/TLS to protect it's password-equivalent tokens on-the-wire. Getting an SSL cert onto the device (at a reasonable cost) so that a phone connecting to it via wifi doesn't throw up big scarey "somebody might be doing _bad_ things!" warnings is not easily solved. (1) Shameless self promotion: http://holiday.moorescloud.com http://holiday.moorescloud.com - The world's most intelligent christmas lights…

reirob 13y ago

This question has been asked in the comments to the article and there is answer: "Heninger et al. did check their data for “Debian weak keys.” They found 4,147 such TLS keys and 53,141 SSH keys."