Rendered at 09:07:11 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
tptacek 14 hours ago [-]
The most important thing to know about this work, which is awesome, is that it relies on access to a raw RSA oracle, where you have a public key and an API that allows you to directly do RSA operations with the corresponding key. The idea is that you then lose access to the oracle, and thus to the private key, but you've gained enough information from your session with the oracle to make forgeries in the future.
So it's not a straightforward general-purpose RSA-1024 signature break; it's pretty situational. The paper goes into detail (in section 5) about how those situations can emerge in practical scenarios.
deprave 8 hours ago [-]
It’s important to note that by “raw” they mean without padding, which is more rare than just a signing oracle, see section 7 of the paper.
bflesch 14 hours ago [-]
Thank you for this nice explanation. I skimmed the abstract but didn't really understand it.
hn_submit 13 hours ago [-]
[flagged]
tptacek 13 hours ago [-]
I'm pretty sure you just described an IACR paper --- with Nadia Heninger's name on it --- as "clickbait"?
yababa_y 8 hours ago [-]
in the PDF metadata we find the proper and appropriate title of this work:
Nearly SNFS-Speed Signature Forgery Sans Factoring N (NSNFSSSFSFN)
RossBencina 8 hours ago [-]
I was expecting to see mention of Microsoft/Apple executable code-signing in the examples. I know key lengths are well beyond 1024 now, but on the Microsoft side it was (is?) possible for USB tokens to be distributed in the mail. What I don't know is whether the tokens could be used as oracles in this attack.
nk_kolja 13 hours ago [-]
I was unaware of snfs algorithms for generic moduli and/or signatures. Very nice.
The theoretical result is purely due to the 2007 Joux et al. paper.
What’s new is the implementation and the 1024-bit rsa signature forgery.
Also no ai, so we can expect some speedups soon.
I really didn’t expect rsa to be targeted so much this year. Hope that these results will motivate people to pursue algorithmic improvements!
benmmurphy 11 hours ago [-]
nice poem at the end of the paper
upofadown 8 hours ago [-]
From the article:
>Still, some real-world systems continue to use blind-signature, also known as textbook, RSA.
I think those are two different things.
keeganryan 14 hours ago [-]
[dead]
pseudohadamard 3 hours ago [-]
Another piece of overblown academic panic-mongering. It's been known since forever that you never use RSA that way, which is why every single standard that specifies RSA use also specifies padding mechanisms designed to avoid this, but nowhere in the title or abstract, which is about all that 99% of non-cryptographers will read, does it ever mention this. In fact it's written to imply the exact opposite.
This is not "we broke RSA", it's "we managed to find an implementation you've probably never heard of before that's so broken that an attack that nothing should be vulnerable to is actually feasible". This is a blog post, not a news story. I found a much bigger vuln than this in Android RSA auth some years ago, I'm talking beginner-level crypto misuse, told Google about it, and it was quietly fixed. I didn't publish a paper about it or get it in the news because it was a non-story.
Except that in this case every single piece of crypto code or downstream app out there that has the name "RSA" associated with it, which is all of them, has to reassure every one of its users who have seen the news headline that no, it's overblown hype, you're not vulnerable, nothing to do since there's no vulnerability present in your use of RSA.
The worst possible outcome would be if this thing actually gets a CVE assigned to it. How do you fix a "vulnerability" that doesn't exist?
angry_octet 2 hours ago [-]
It is a rare privilege to read such volcanic straw-manning.
So it's not a straightforward general-purpose RSA-1024 signature break; it's pretty situational. The paper goes into detail (in section 5) about how those situations can emerge in practical scenarios.
Also no ai, so we can expect some speedups soon.
I really didn’t expect rsa to be targeted so much this year. Hope that these results will motivate people to pursue algorithmic improvements!
>Still, some real-world systems continue to use blind-signature, also known as textbook, RSA.
I think those are two different things.
This is not "we broke RSA", it's "we managed to find an implementation you've probably never heard of before that's so broken that an attack that nothing should be vulnerable to is actually feasible". This is a blog post, not a news story. I found a much bigger vuln than this in Android RSA auth some years ago, I'm talking beginner-level crypto misuse, told Google about it, and it was quietly fixed. I didn't publish a paper about it or get it in the news because it was a non-story.
Except that in this case every single piece of crypto code or downstream app out there that has the name "RSA" associated with it, which is all of them, has to reassure every one of its users who have seen the news headline that no, it's overblown hype, you're not vulnerable, nothing to do since there's no vulnerability present in your use of RSA.
The worst possible outcome would be if this thing actually gets a CVE assigned to it. How do you fix a "vulnerability" that doesn't exist?