[Cryptography] Logjam (Peter Fairbrother)
ianG
iang at iang.org
Thu Jun 11 20:39:15 EDT 2015
(Peter Fairbrother asked me to forward the following to list, words
below not mine)
I don't know why, but I haven't been able to collect emails from the
list, or send the list emails, for a while. I don't even know whether I
am still subscribed to the list.
If I had, there are a couple of issues I would have raised - I have
skimmed the archives and found no mention of either, but the thread
titles don't always reveal much about the content, so if I am repeating
others' words or thoughts please forgive me.
First, the Logjam attack, and the state-level attacks mentioned in the
logjam paper. https://weakdh.org/
Logjam, like FREAK, degrades crypto suites, in this case TLS DH to
512-bit "export grade" crypto. It's a bit more sophisticated than FREAK,
but not much.
7th principle: Holes for "good guys" are holes for bad guys too.
8th principle: In code, nothing ever really goes away.
(big nod to Jerry Leichter here)
More controversial, and quite possibly more damaging, is this:
"Threats from state-level adversaries.
Millions of HTTPS, SSH, and VPN servers all use the same prime numbers
for Diffie-Hellman key exchange. Practitioners believed this was safe as
long as new key exchange messages were generated for every connection.
However, the first step in the number field sieve — the most efficient
algorithm for breaking a Diffie-Hellman connection — is dependent only
on this prime. After this first step, an attacker can quickly break
individual connections.
[...]
A close reading of published NSA leaks shows that the agency's attacks
on VPNs are consistent with having achieved a break [of the single, most
common 1024-bit prime]."
I wonder whether the "state level threat" of breaking common 1024-bit DH
primes is the "major breakthrough" which NSA told Congress about a few
years ago, for which they got all that lovely extra money.
If so, the people who in 2013 were supporting the idea of replacing
2048-bit RSA with ubiquitous 1024-bit DH in order to provide FS look a
bit silly ..
[ the major browsers supported 1024-bit DH but 2048-bit RSA, perhaps due
to people mistakenly thinking that DH keys needed to be half the size of
RSA keys - it might be interesting to see where that rumour came from.
To quote Peter Gutmann, posting here:
"It's a debate between two groups, the security practitioners, "we'd
like a PFS solution as soon as we can, and given currently-deployed
infrastructure DH-1024 seems to be the best bet", and the theoreticians,
"only a theoretically perfect solution is acceptable, even if it takes
us forever to get it"." ]
.. as the only people who could partially break 2048-bit RSA were the
major agencies (gimme the private keys sunshine, or go to jail), the
same ones who could almost universally break 1024-bit DH, but without
the hassle of warrants or anyone else knowing about it ..
By the way, this was just after Snowden, when Google and the like were
moving to 2048-bit RSA, and other people were running around like
headless chickens saying "we must do something".
NSA must have been laughing all the way to the bank.
-- Peter Fairbrother
More information about the cryptography
mailing list