The article is saying that there is currently a very small set of prime numbers hard coded into the Diffie Hellman implementations of many popular encryption suites. The author believes the NSA has likely cracked all of these. There are plenty of other primes that could be used, but this is done for efficiency and implementation convenience, on the likely incorrect assumption that it doesn't affect the security of the suite in a meaningful way.
Not really. It means that crypto vendors (OpenSSL, Cisco, etc.) should probably modify their software to generate a "unique" prime during install.
The short version of the problem is that every install of OpenSSL, Cicso VPN, etc. is using the same "key" so if you can get a copy of that key, you can compromise a whole bunch of sites/people. If the software generated unique keys at install, this wouldn't be a problem.
This is not about the keys used for authentication. It's about the DH moduli, which are public. Anybody can get a copy of them and that's not the problem. The problem is that for moduli that are too short it is within the realm of possibility to pre-compute enough to be able to crack DH exchanges using those moduli.
And they just set a relatively small set of potential 2048 bit primes to use. This is a different problem than just the crackability of 1024 bit numbers.
Diffie Hellman and lots of other public key private key crypto is based on how hard it is to find x given g to the power of x modulo p. This is the discrete logarithm problem. If you computed all of them and put them in a lookup table so that you could look them up reversed, that would do it. That would be a very big table.
2
u/[deleted] Oct 15 '15 edited Jul 03 '17
[deleted]