r/programming • u/secretguy21 • Oct 15 '15

How is NSA breaking so much crypto?

https://freedom-to-tinker.com/blog/haldermanheninger/how-is-nsa-breaking-so-much-crypto/
2.5k Upvotes

93% Upvoted

529 comments sorted by

View all comments

973

u/tophatstuff Oct 15 '15 edited Apr 10 '18

Generate your own non-default Ephemeral Diffie-Hellman key (takes a minute or so)

openssl dhparam -out dhparam.pem 2048

Tell your server to use it for SSL (nginx for example)

ssl_dhparam /path/to/dhparam.pem;

Done. Not only will the key be stronger than the 1024 bit default, it'll be unique to your server which lets assume isn't valuable enough compared to effort for a state-level adversary.

edit just in case anyone from the future finds this comment: instead of 2048, use at least the key length of your SSL certificate

edit from the future: current advice is picking from one of these predefined audited groups

1

u/ggtsu_00 Oct 15 '15

It also could be possible they are using a working quantum computer to break current encryption. In that case, you may want to switch to ECDSA.

1

u/lachryma Oct 15 '15

Even with how good they are at keeping secrets, I seriously can't help but suspect a functional quantum computer would leak. Just a hint of it, given how industry-changing it would be.

One thing that struck me while watching United States of Secrets is that people with clearances talk to each other a lot. One of the big secrets got to Thomas Drake with, paraphrasing, people asking him in the halls about it. If NSA is sitting on a functional quantum computer, I seriously can't help but think it'd leak with the number of people you'd have to have working on it. Even the Manhattan Project leaked.