<story><title>N.S.A. Foils Much Internet Encryption</title><url>http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html</url></story><parent_chain><item><author>tc</author><text>This is really damaging.&lt;p&gt;Not only will this cause other countries to put up barriers against US (and UK) services and products, it&amp;#x27;s going to affect uptake of standards developed here.&lt;p&gt;On the lighter side, a treasure hunt was just announced.  Can you find one of these vulnerabilities, or evidence of the NSA having attacked a particular system to steal keys?&lt;p&gt;----&lt;p&gt;[Edit 1] Some speculation:&lt;p&gt;By careful hardware design -- and lots of it -- the NSA may be able to find keys large enough that we would be mildly surprised but not shocked.  It&amp;#x27;s not well known that searching for &lt;i&gt;many&lt;/i&gt; keys in parallel amortizes well -- it&amp;#x27;s much cheaper than finding all the keys individually.  DJB has a great paper about this:&lt;p&gt;&lt;a href=&quot;http://cr.yp.to/snuffle/bruteforce-20050425.pdf&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;cr.yp.to&amp;#x2F;snuffle&amp;#x2F;bruteforce-20050425.pdf&lt;/a&gt;&lt;p&gt;If I were looking for subverted hardware, I&amp;#x27;d be really interested in reverse engineering Ethernet chips and BMCs.  The CPU would be an obvious choice as well -- could there be some sequence of instructions that enables privilege escalation?&lt;p&gt;On protocols, the best sort of vulnerability for the NSA would be the kind that is still somewhat difficult and expensive to exploit.  They want the security lowered just far enough that they can get the plaintext, but not so far that our adversaries can.&lt;p&gt;There is some history with not taking timing attacks seriously enough.  Perhaps careful timing observation, which the NSA is well positioned to do, could give more of an edge than we suspect.  Or perhaps you could push vendors to make their products susceptible to this kind of attack, secure in the belief that it may be difficult for others to detect.&lt;p&gt;[Edit 2]&lt;p&gt;I gave a talk that discussed what I think we as engineers should do here:&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=c7oK59DZwR4#t=1m46s&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=c7oK59DZwR4#t=1m46s&lt;/a&gt;&lt;p&gt;And Phil Zimmermann and I discussed a number of these issues in a Q&amp;amp;A session:&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=W42i8zCEizI#t=49m55s&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=W42i8zCEizI#t=49m55s&lt;/a&gt;</text></item></parent_chain><comment><author>mrb</author><text>I think we know very well which encryption has been foiled by the NSA. This is not speculation, but quasi-certainty: 1024-bit RSA.&lt;p&gt;- Crytographers all acknowledge 1024-bit RSA is dead [1].&lt;p&gt;- Attack cost 10 years ago was estimated to be a few million USD to build a device able to crack a 1024-bit key every 12 months [2].&lt;p&gt;- &amp;quot;Much of&amp;quot; the &amp;quot;secure&amp;quot; HTTPS websites use such weak key sizes [3].&lt;p&gt;- NSA had a budget of 10.8 billion USD in 2013.&lt;p&gt;Drawing a conclusion is not very hard.&lt;p&gt;[1] &lt;a href=&quot;http://arstechnica.com/uncategorized/2007/05/researchers-307-digit-key-crack-endangers-1024-bit-rsa/&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;arstechnica.com&amp;#x2F;uncategorized&amp;#x2F;2007&amp;#x2F;05&amp;#x2F;researchers-307...&lt;/a&gt;
[2] &lt;a href=&quot;http://www.cs.tau.ac.il/~tromer/twirl/&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.cs.tau.ac.il&amp;#x2F;~tromer&amp;#x2F;twirl&amp;#x2F;&lt;/a&gt;
[3] &lt;a href=&quot;https://www.eff.org/pages/howto-using-ssl-observatory-cloud&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.eff.org&amp;#x2F;pages&amp;#x2F;howto-using-ssl-observatory-cloud&lt;/a&gt;</text></comment>
<story><title>N.S.A. Foils Much Internet Encryption</title><url>http://www.nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html</url></story><parent_chain><item><author>tc</author><text>This is really damaging.&lt;p&gt;Not only will this cause other countries to put up barriers against US (and UK) services and products, it&amp;#x27;s going to affect uptake of standards developed here.&lt;p&gt;On the lighter side, a treasure hunt was just announced.  Can you find one of these vulnerabilities, or evidence of the NSA having attacked a particular system to steal keys?&lt;p&gt;----&lt;p&gt;[Edit 1] Some speculation:&lt;p&gt;By careful hardware design -- and lots of it -- the NSA may be able to find keys large enough that we would be mildly surprised but not shocked.  It&amp;#x27;s not well known that searching for &lt;i&gt;many&lt;/i&gt; keys in parallel amortizes well -- it&amp;#x27;s much cheaper than finding all the keys individually.  DJB has a great paper about this:&lt;p&gt;&lt;a href=&quot;http://cr.yp.to/snuffle/bruteforce-20050425.pdf&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;cr.yp.to&amp;#x2F;snuffle&amp;#x2F;bruteforce-20050425.pdf&lt;/a&gt;&lt;p&gt;If I were looking for subverted hardware, I&amp;#x27;d be really interested in reverse engineering Ethernet chips and BMCs.  The CPU would be an obvious choice as well -- could there be some sequence of instructions that enables privilege escalation?&lt;p&gt;On protocols, the best sort of vulnerability for the NSA would be the kind that is still somewhat difficult and expensive to exploit.  They want the security lowered just far enough that they can get the plaintext, but not so far that our adversaries can.&lt;p&gt;There is some history with not taking timing attacks seriously enough.  Perhaps careful timing observation, which the NSA is well positioned to do, could give more of an edge than we suspect.  Or perhaps you could push vendors to make their products susceptible to this kind of attack, secure in the belief that it may be difficult for others to detect.&lt;p&gt;[Edit 2]&lt;p&gt;I gave a talk that discussed what I think we as engineers should do here:&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=c7oK59DZwR4#t=1m46s&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=c7oK59DZwR4#t=1m46s&lt;/a&gt;&lt;p&gt;And Phil Zimmermann and I discussed a number of these issues in a Q&amp;amp;A session:&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=W42i8zCEizI#t=49m55s&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.youtube.com&amp;#x2F;watch?v=W42i8zCEizI#t=49m55s&lt;/a&gt;</text></item></parent_chain><comment><author>tptacek</author><text>I would not be at all surprised to learn that the major advance these disclosures refer to is an on-demand RSA-1024 factoring capability. RSA-1024 is already known to be unsafe (Eran Tromer estimates a 7 figure cost for a dedicated hardware cracker, which is approximately the threshold DES was at in the late &amp;#x27;90s, when nobody believed DES was secure). On-demand offline RSA-1024 attacks would have major implications, would be a huge advance in the state of the art, but also seems feasible given an effectively unlimited budget.</text></comment>