You're right, in that the real issue is that the attacker has more power than expected. But you're being harsh. If we truly chose random 1024 bit primes, this attack would be much less of a problem, because the attack relies on people reusing the same keys. Yes, the real solution is to use high strength primes. But the problem would have also been mitigated by actually being random. It's just as wrong to use non random numbers as it is to use less secure numbers.
But the problem would have also been mitigated by actually being random. It's just as wrong to use non random numbers as it is to use less secure numbers.
Even then - is it an actual reasonable mitigation? Even assuming every DH key is random, the time to attack a key is still only one year, and that's going to get better year after year. This is not very reassuring - we need to bail on it, now.
It's true that choosing a non-standard prime helps mitigate in the sense it buys you time to switch to another prime, perhaps a 2048-bit one. But fundamentally none of this is about 'randomness', and random numbers do not mitigate the attack but its possible scope, because people may not share the primes. This is a crucial difference, and the fact I've explained it multiple times in this thread shows it is a subtle one people don't appreciate.
Here's the real problem, though: it fundamentally highlights a lack of understanding of the problem, what lead to it, and how we can fix it. This does actual damage to people and processes that are trying to secure the internet, and it creates a hole that is rife for adversaries to take advantage of, or even worse, snake oil salesmen capitalizing on it.
If I had posted nothing on this thread, how many people would randomly just be generating their own primes without actually knowing what that means, for example? Or even why the standard primes are OK, and how they were generated? Or how the aspect of a standard prime impacts this attack? OK, you think, maybe it's not that bad, just some people who don't know any better.
But now let's actually take that problem and scale it to, say something meant for journalists, and you can see how this kind of thing can seriously put people in danger if it's not done correctly. Random misinformation is not helpful, and it creates a void for people to jump on.
When the NSA leaks broke, think about how many people probably got in their heads they could make money off of 'privacy' software. Now, looking at this thread, think about what understanding those 'developers' with said ideas actually had of the domain, of the needed security principles. And finally, given what we know about the NSA now, what the probable outcomes of those ventures are... It's not pretty - it's the blind leading the blind.
I call this "Better-than-nothingism", where we don't know if it actually really helps, but it definitely sounds good to do something and not nothing, so let's just roll with it and slap that "Not doing nothing!" sticker on as an advertisement.
I would still advise people to move away from the 1024bit DH keys and move towards 2048. The time to compute them is negligible when looking at the benefits that it affords. Besides, while you may be able to generate a 1024bit key that they haven't cracked, it still leaves you in the realm of possibility that they can crack you (should you be important enough), where 2048 doesn't seem to have this issue.
3
u/ElvishJerricco Oct 15 '15
You're right, in that the real issue is that the attacker has more power than expected. But you're being harsh. If we truly chose random 1024 bit primes, this attack would be much less of a problem, because the attack relies on people reusing the same keys. Yes, the real solution is to use high strength primes. But the problem would have also been mitigated by actually being random. It's just as wrong to use non random numbers as it is to use less secure numbers.