Scientists crack RSA SecurID 800 tokens, steal cryptographic keys
arstechnica.com
arstechnica.com
The security of these hardware devices is not tied to the RSA algorithm per se. The devices might not be more resilient against these attacks simply by using ECC instead of RSA.
Either way: don't implement RSA or ECC yourself. Use something like PGP/GPG.
I'm not even sure what the encryption technology is called, but it would be very cool to play with.
Patents used to be the reason ECC was rarely used (that and novelty), but there are ECC systems in somewhat wide use that aren't patent-licensed.
Schneier on the attack: http://www.wired.com/politics/security/commentary/securityma...
When you do require a "magic constant" in a cryptographic algorithm, it is common to show good faith by deriving it in a way that would make it difficult to embed a backdoor. For instance ascii text, digits of pi, or the lowest AES encrypted number that fulfils certain criteria.
Edit: these is also called "nothing up my sleeve numbers".
When you do require a "magic constant" in a cryptographic algorithm, it is common to show good faith by deriving it in a way that would make it difficult to embed a backdoor. For instance ascii text, digits of pi, or the lowest AES encrypted number that fulfils certain criteria.
The initialization constant in SipHash is awesome: "somepseudorandomlychosenbytes".
Given the horrible performance of that PRNG, I wonder if anyone implements it, securely I would hope (with random point generation rather than using the "recommended" possibly insecure points).
(Edit: never mind, it looks like it's a chosen plaintext attack against the RSA on the device, not a direct hack. So yeah, this is cryptographically impressive. It looks like they're exploiting a bad padding protocol?)
The former is probably the best known cryptanalytic attack in the world (it's the one Thai Duong and Juliano Rizzo used against J2EE and .NET 2 years ago, and there are publicly available attack tools that will attempt to exploit it against arbitrary targets.
The latter is Bleichenbacher's, very well known in the literature but not widely exploited (this is a crypto attack that involves some linear algebra).
The rough sketch of both attacks is similar. It exploits a target that holds a secret key and reacts to arbitrary attacker-chosen messages. The attacker has no knowledge of the key, but might have knowledge of a known-good message. The attacker modifies the message in targeted ways and sends to the target; the target attempts to decrypt the message; the decryption goes haywire (because the attacker has modified the message without knowing the key); the target's behavior changes visibly as a result of the decryption going haywire.
The attacker knows (1) the nature of the targeted change they made, and (2) whether or not the target reacted weirdly (raised an error, took longer to respond, failed to respond).
The attacker continues changing messages and collecting 2-tuples of [change, result]. The whole cryptographic attack then analyzes the list of 2-tuples and from it discerns some secret.
Until then, one eye always open.
Aside from that, I'm not sure why OTPs aren't more commonly used. They're easy to reason about, and while you still need some protocol to use them correctly, it would seem that protocol would be much simpler than for fancy crypto like RSA.
Neither RSA nor AES were damaged by this attack.
Mailing? That's not secure enough.. You have to go to Facebook HQ and get your weekly OTP. Daily if you post a lot of images =)