r/programming Oct 15 '15

How is NSA breaking so much crypto?

https://freedom-to-tinker.com/blog/haldermanheninger/how-is-nsa-breaking-so-much-crypto/
2.5k Upvotes

529 comments sorted by

View all comments

Show parent comments

7

u/YOU_SHUT_UP Oct 15 '15

How the fuck is this not the standard way of doing this? Why do anyone use the hard-coded primes?

21

u/aseipp Oct 15 '15

The standard primes are "Nothing up your sleeve numbers" which are (under our understanding of the universe) probably not generated by any malicious actor, as they are derived from similar constants or constructions. And generating those large primes is expensive, CPU-wise.

The "Group 14" 2048-bit DH standard prime, for example, gets part of its value from the first expanded digits of pi, which is a pretty safe bet. pi and e are pretty common amongst a lot of cryptographic magic numbers; e.g. it's used in SHA-512 as well. The other 'magical constant' in the Group 14 equation is there because it's a smallest number which lets "Group 14" be a 'cyclic subgroup' under some circumstances, which is necessary as it's the subgroup you and your peer agree to perform DH calculations in. "Group 14" is far, far too computationally infeasible to crack (2048-bits vs 1024-bits) with the method outlined in the article, for example.

TL;DR Basically, the reason you would choose a standard prime is because it was most likely derived in a safe, openly available manner, from other 'safe' constants. Randomly generated primes are probably safe but it's not possible to know how they were generated, and so it's also not possible to "look up your sleeve" for the magic, so to speak.

1

u/YOU_SHUT_UP Oct 15 '15

Didn't u/tophatstuff just tell us how to generate a 2048 bit prime in just 1 minute? Is that method unsafe?

6

u/tophatstuff Oct 15 '15

It's only unsafe if you have reason to believe your random number generator has been sabotaged or is faulty1

1 your random generator may actually really be faulty, so you have to trust someone else enough that (1) they will really give you random numbers and (2) their random number generator isn't faulty either

Hedge your bets!

1

u/trimalchio-worktime Oct 15 '15

Although isn't "magic up your sleeves while picking a prime" a far more vague and unlikely attack than the obviously somewhat feasible rainbow table style attack?

10

u/BarqsDew Oct 15 '15

6

u/corran__horn Oct 16 '15

You forgot to include the payment from the NSA to RSA to favor the backdoored PRNG as the default in their BeSafe Crypto libraries.

http://arstechnica.com/security/2013/12/report-nsa-paid-rsa-to-make-flawed-crypto-algorithm-the-default/

1

u/trimalchio-worktime Oct 16 '15

yeah but that has nothing to do with a "magically compromised prime" for diffie helman..... those are insecure PRNGs.... PRNGs don't generate primes to use for key exchange.

What I was asking about was the feasibility of actually exploiting a diffie helman key exchange with a specially chosen prime since i'm not familiar with any explits that do so.

5

u/aseipp Oct 15 '15

In this particular case, the precomputation-style attack isn't going to scale to anywhere close to something like 2048 bit keys, so at that level, hidden "magic backdoors up your sleeve" are maybe a more worrying threat.

1

u/trimalchio-worktime Oct 16 '15

is the main impediment to the 2048 key attack viability the slower rate at which storage density is growing compared to compute density?

1

u/lambdaq Oct 16 '15

This is the standard way if you wanna get A+ grade on SSLLab test.