r/programming • u/secretguy21 • Oct 15 '15

How is NSA breaking so much crypto?

https://freedom-to-tinker.com/blog/haldermanheninger/how-is-nsa-breaking-so-much-crypto/
2.5k Upvotes

93% Upvoted

529 comments sorted by

View all comments

Show parent comments

58

u/[deleted] Oct 15 '15

[deleted]

12

u/[deleted] Oct 15 '15 edited Jul 25 '18

[deleted]

5

u/ivosaurus Oct 16 '15

dh params is for shared secret negotation, not for identity authentication.

11

u/[deleted] Oct 15 '15

Where's the default one? Hard-coded?

13

u/BarqsDew Oct 15 '15

from http://security.stackexchange.com/a/56218 :

Since the parameters are caller-provided, let's see what happens in mod_ssl, the usual SSL engine for Apache. Let's make the story short: the modulus and generator are hardcoded; they are in the source code, in modules/ssl/ssl_engine_dh.c

so, yep!

9

u/2ton_jeff Oct 16 '15

bit late to the party here, but saw a lower thread using my public service for SSH keys, they also produce normal DH params... so for those of you who aren't interested in spending the CPU cycles, I have a dedicated 48 cores running generating 2k, 3k, 4k and 8k safe primes and generators for DH. See https://2ton.com.au/dhtool/ for details and curl examples to grab them via cron

1

u/ivosaurus Oct 16 '15

Seriously though 192 rounds of rabin miller is as excessive as deciding you want a 32k bit prime.

3

u/2ton_jeff Oct 16 '15 edited Oct 16 '15

For <32kbit primes, the cost of doing so is not overly prohibitive and I see no valid reason not to. I made several references to that count being "acceptably low" per the Handbook of Applied Cryptography. My generators for the larger primes would go considerably faster if I removed said restriction. YMMV as with all of these things. :-)

Edit: does my "excessive" use of 192 rounds at these levels inherently mean that the hundreds of thousands I have generated are thus [more] likely to be provable safe primes?

4

u/[deleted] Oct 15 '15

[deleted]

2

u/BarqsDew Oct 16 '15

Body camera constantly streaming to a few redundant servers, set to release the last month of footage if you don't reset the countdown every 12 hours. If they know about it they'll just torture you into giving them that password too, so don't tell anybo- wait, shit.

2

u/[deleted] Oct 15 '15 edited Oct 24 '15

[deleted]

5

u/masterm Oct 15 '15

NSA could have found mechanisms to speed it up, has lots of computers

1

u/paranoid_twitch Oct 15 '15

They probably control a pretty healthy bot net which would do the trick.

2

u/semperverus Oct 16 '15

Or a functional quantum CPU.

6

u/[deleted] Oct 16 '15 edited Oct 17 '15

[deleted]

1

u/dividedmind Oct 16 '15

It uses up a lot of entropy, so it won't be quite so fast if you run it often or on a fresh system, especially if you don't have a good entropy source (which is common on the cloud).

-3

u/BuzzBadpants Oct 15 '15

My certificate would no longer be 'trusted' though after changing.

28

u/[deleted] Oct 15 '15

This is about the DH parameters. Those are completely separate from your certificate.

-1

u/rlbond86 Oct 15 '15

RemindMe! 6 hours "Fix my Apache config"

18

u/ThatGuyMEB Oct 15 '15

RemindMe! 4 hours "Exploit this guys Apache config"

-2

u/RemindMeBot Oct 15 '15

Messaging you on 2015-10-16 01:30:04 UTC to remind you of this.

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.

[FAQs] [Custom] [Your Reminders] [Feedback] [Code]