5 ms·

8192+ bit RSA keys in OS X

72 points by robbiet480 13y ago

asdfaoeu 13y ago
Annoyingly, StartSSL doesn't support ECDSA (well say they are less than the required 1024 bits, which they are but are more secure comparably).
plorkyeran 13y ago
Note that iOS has the same issue, except there's no way to change the relevant setting (AFAIK), and in general 8k keys are likely to be prohibitively slow on mobile.
gfosco 13y ago
Is he going to have to tell everyone who uses these affected versions of OS X to run these commands / change these preferences in order to view his site? This is much worse than he expressly states... How many people are going to put in the effort to contact the site author, or investigate the error, instead of writing off the site entirely? My takeaway from this is not to update a machine to be able to view a site with large certificates, it is to not use large certificates until Apple releases a fix for this.
Demiurge 13y ago
So what's the actual limit it is set to by default? If I get a certificate, I'm not exactly going to tell everyone to run a sudo command before opening the site :)
- mkhalil 13y ago
  Just looked, couldn't even find the file. /Library/Preferences/com.apple.security OSX 10.9
  - Zr40 13y ago
    com.apple.security isn't a file, it's a preferences domain. Preference domains are stored in ~/Library/Preferences/<domain>.plist for per-user domains, and /Library/Preferences/<domain>.plist for system domains. In this case, it's stored in /Library/Preferences/com.apple.security.plist. If a preferences domain doesn't exist (or if the key doesn't exist within the domain), the app or system default is used.
- deleted 13y ago
  [deleted]
- andrewcooke 13y ago
  4096 according to the code linked to in the article - http://opensource.apple.com/source/Security/Security-55471/libsecurity_apple_csp/lib/RSA_DSA_keys.h http://opensource.apple.com/source/Security/Security-55471/l...
  - apaprocki 13y ago
    I noticed the Certificate Assistant UI in Keychain Access only lets you choose as high as 2048 bits if you're generating certs that way.
BoppreH 13y ago
8192 bit RSA key is one or two notches above overkill. 2048 is expected to last many more decades, and I haven't seen 4096 outside tin-foil hat environments. I know our national root certification authority uses 4096, for example. I propose such a key actually decreases security because it is less compatible with existing software, training the users to further ignore warnings or dangerously tinker with their security settings. Which one is more likely? NSA being able to break 4096 keys, but not 8192, or your user accepting an invalid certificate because "the key is probably just too big", or "it drains too much battery"? Which one will have more impact down the line? Besides, if you are worried about such sophisticated attackers, your priority should be securing side channels and protecting yourself from rubber-hose cryptanalysis (http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis).
- handsomeransoms 13y ago
  It's extravagant, and doesn't provide meaningful security. How much do you pay the armed guards that stand watch over your laptop 24/7? "Using encryption on the Internet is the equivalent of arranging an armored car to deliver credit card information from someone living in a cardboard box to someone living on a park bench." — Gene Spafford (Hat tip to schoen: http://www.loyalty.org/~schoen/rsa/ http://www.loyalty.org/~schoen/rsa/)
  - quesera 13y ago
    Surely Spaf has recanted by now.
    - declan 13y ago
      If I read this recent (post-Snowden) blog post of spaf's correctly, he hasn't: https://www.cerias.purdue.edu/site/blog/post/just_sayin/ https://www.cerias.purdue.edu/site/blog/post/just_sayin/ Though he notes that his armored car quip is approaching 20 years old, dating back to the dark days of Windows 95. Perhaps the better way to think about it is: encryption is necessary but not sufficient. If the NSA has extruded its tentacles into sufficient endpoints (operating systems? firmware? antivirus software?) that's a problem that encryption won't by itself solve. Hey, I'm channeling RMS: free software is the real solution! Unless the NSA's tentacles extend to the compiler you use to compile the free software. :)
apaprocki 13y ago
Too funny -- I just went through this same exercise to see what the limits were and figured nobody would actually care about it since > 2048 bits is a little bit crazy. I also found that TLS1.2 is not supported in Mail.app on Mavericks, even though it is supported in Safari. I wanted to see if I could enable TLS1.2-only AES-GCM on everything and quickly found the SMTP/IMAP TLS support is lacking.
m_eiman 13y ago
For reference, this is how fast OpenSSL is with various key sizes on my Core i5, 2.6GHz: sign verify sign/s verify/s rsa 512 bits 0.000192s 0.000014s 5209.8 72185.6 rsa 1024 bits 0.000909s 0.000037s 1100.4 27318.3 rsa 2048 bits 0.004911s 0.000109s 203.6 9180.2 rsa 4096 bits 0.030147s 0.000413s 33.2 2419.1
- csmuk 13y ago
  Thanks for posting this. I've always wondered what the numbers were. 4096 bits does appear to add a significant work factor.
  - m_eiman 13y ago
    Extrapolating a bit, the numbers for 8kb keys should be about 5 sign/sec, 500 verify/sec.
wellboy 13y ago
Doesn´t it take 10^100 universes to crack 8192 bit RSA?
- lutusp 13y ago
  > Doesn´t it take 10^100 universes to crack 8192 bit RSA? That's easy to test: a = 2^8192 ≅ 1.09 * 10^2466 (http://www.wolframalpha.com/input/?i=2%5E8192 http://www.wolframalpha.com/input/?i=2%5E8192) b = 10^100 universes If we assume one universe can only crack one value, then we need many more than 10^100 universes. But it's reasonable to assume that one universe can crack more than one encrypted value. Let's say that each universe can crack a million values. Then 10^100 universes is too many.
fsiefken 13y ago
Alternatively one could use Elliptic Curve Cryptography to mitigate potential DOS issues as it less computationally intensive. For example a 409 ECC key is equivalent to a 7680 RSA key. For more on this read "ECC Cipher Suites for TLS", RFC 4492. http://www.ietf.org/rfc/rfc4492.txt http://www.ietf.org/rfc/rfc4492.txt Be sure to take note of which curves to use as only some are supported by the TLS standard: http://stackoverflow.com/questions/16334662/some-elliptic-curves-in-openssl-give-no-shared-cipher-errors http://stackoverflow.com/questions/16334662/some-elliptic-cu...

72 points by robbiet480 13y ago

Annoyingly, StartSSL doesn't support ECDSA (well say they are less than the required 1024 bits, which they are but are more secure comparably).

plorkyeran 13y ago

Note that iOS has the same issue, except there's no way to change the relevant setting (AFAIK), and in general 8k keys are likely to be prohibitively slow on mobile.

gfosco 13y ago

Is he going to have to tell everyone who uses these affected versions of OS X to run these commands / change these preferences in order to view his site? This is much worse than he expressly states... How many people are going to put in the effort to contact the site author, or investigate the error, instead of writing off the site entirely? My takeaway from this is not to update a machine to be able to view a site with large certificates, it is to not use large certificates until Apple releases a fix for this.

Demiurge 13y ago

So what's the actual limit it is set to by default? If I get a certificate, I'm not exactly going to tell everyone to run a sudo command before opening the site :)

mkhalil 13y ago
Just looked, couldn't even find the file. /Library/Preferences/com.apple.security OSX 10.9
- Zr40 13y ago
  com.apple.security isn't a file, it's a preferences domain. Preference domains are stored in ~/Library/Preferences/<domain>.plist for per-user domains, and /Library/Preferences/<domain>.plist for system domains. In this case, it's stored in /Library/Preferences/com.apple.security.plist. If a preferences domain doesn't exist (or if the key doesn't exist within the domain), the app or system default is used.
deleted 13y ago
[deleted]
andrewcooke 13y ago
4096 according to the code linked to in the article - http://opensource.apple.com/source/Security/Security-55471/libsecurity_apple_csp/lib/RSA_DSA_keys.h http://opensource.apple.com/source/Security/Security-55471/l...
- apaprocki 13y ago
  I noticed the Certificate Assistant UI in Keychain Access only lets you choose as high as 2048 bits if you're generating certs that way.

BoppreH 13y ago

8192 bit RSA key is one or two notches above overkill. 2048 is expected to last many more decades, and I haven't seen 4096 outside tin-foil hat environments. I know our national root certification authority uses 4096, for example. I propose such a key actually decreases security because it is less compatible with existing software, training the users to further ignore warnings or dangerously tinker with their security settings. Which one is more likely? NSA being able to break 4096 keys, but not 8192, or your user accepting an invalid certificate because "the key is probably just too big", or "it drains too much battery"? Which one will have more impact down the line? Besides, if you are worried about such sophisticated attackers, your priority should be securing side channels and protecting yourself from rubber-hose cryptanalysis (http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis).

handsomeransoms 13y ago
It's extravagant, and doesn't provide meaningful security. How much do you pay the armed guards that stand watch over your laptop 24/7? "Using encryption on the Internet is the equivalent of arranging an armored car to deliver credit card information from someone living in a cardboard box to someone living on a park bench." — Gene Spafford (Hat tip to schoen: http://www.loyalty.org/~schoen/rsa/ http://www.loyalty.org/~schoen/rsa/)
- quesera 13y ago
  Surely Spaf has recanted by now.
  - declan 13y ago
    If I read this recent (post-Snowden) blog post of spaf's correctly, he hasn't: https://www.cerias.purdue.edu/site/blog/post/just_sayin/ https://www.cerias.purdue.edu/site/blog/post/just_sayin/ Though he notes that his armored car quip is approaching 20 years old, dating back to the dark days of Windows 95. Perhaps the better way to think about it is: encryption is necessary but not sufficient. If the NSA has extruded its tentacles into sufficient endpoints (operating systems? firmware? antivirus software?) that's a problem that encryption won't by itself solve. Hey, I'm channeling RMS: free software is the real solution! Unless the NSA's tentacles extend to the compiler you use to compile the free software. :)

apaprocki 13y ago

Too funny -- I just went through this same exercise to see what the limits were and figured nobody would actually care about it since > 2048 bits is a little bit crazy. I also found that TLS1.2 is not supported in Mail.app on Mavericks, even though it is supported in Safari. I wanted to see if I could enable TLS1.2-only AES-GCM on everything and quickly found the SMTP/IMAP TLS support is lacking.

m_eiman 13y ago

For reference, this is how fast OpenSSL is with various key sizes on my Core i5, 2.6GHz: sign verify sign/s verify/s rsa 512 bits 0.000192s 0.000014s 5209.8 72185.6 rsa 1024 bits 0.000909s 0.000037s 1100.4 27318.3 rsa 2048 bits 0.004911s 0.000109s 203.6 9180.2 rsa 4096 bits 0.030147s 0.000413s 33.2 2419.1

csmuk 13y ago
Thanks for posting this. I've always wondered what the numbers were. 4096 bits does appear to add a significant work factor.
- m_eiman 13y ago
  Extrapolating a bit, the numbers for 8kb keys should be about 5 sign/sec, 500 verify/sec.

wellboy 13y ago

Doesn´t it take 10^100 universes to crack 8192 bit RSA?

lutusp 13y ago
> Doesn´t it take 10^100 universes to crack 8192 bit RSA? That's easy to test: a = 2^8192 ≅ 1.09 * 10^2466 (http://www.wolframalpha.com/input/?i=2%5E8192 http://www.wolframalpha.com/input/?i=2%5E8192) b = 10^100 universes If we assume one universe can only crack one value, then we need many more than 10^100 universes. But it's reasonable to assume that one universe can crack more than one encrypted value. Let's say that each universe can crack a million values. Then 10^100 universes is too many.

fsiefken 13y ago

Alternatively one could use Elliptic Curve Cryptography to mitigate potential DOS issues as it less computationally intensive. For example a 409 ECC key is equivalent to a 7680 RSA key. For more on this read "ECC Cipher Suites for TLS", RFC 4492. http://www.ietf.org/rfc/rfc4492.txt http://www.ietf.org/rfc/rfc4492.txt Be sure to take note of which curves to use as only some are supported by the TLS standard: http://stackoverflow.com/questions/16334662/some-elliptic-curves-in-openssl-give-no-shared-cipher-errors http://stackoverflow.com/questions/16334662/some-elliptic-cu...