Hacker News Reader

Comment by Volundr | Hacker News Reader

> they reversed the public + private parts of the key

Is there a reason this is actually a problem? I always thought the public/private key was arbitrary and it was easier and less error prone to give people one key called public and one called private than hand them two keys and say "ok keep one of these a secret".

Don't get me wrong, not defending anyone here, just curious is there's more to it I don't know.

View on HN

I'd assume that the value intended for public exponent is used as private key exponent. Typically, public key exponent is very small compared to private key exponent. This means that the private key exponent is very small in their scheme, so attacks such as Wiener's attack[0] can be used to break the encryption.

Also, I'd like to add that public exponent is usually fixed to some well-known constant such as 65537, so the attacker might just try brute-forcing when she knows the details of the scheme.

[0]: https://en.wikipedia.org/wiki/Wiener%27s_attack

That's not generally true: typically you can compute the public key from the private key, but not vice versa (i.e. crypto_scalarmult_base() in libsodium).

In RSA, that isn't possible (without assumptions), so a private key file also contains the public key data.

Honestly, I don't know. And as a non-expert on all things crypto, I delegate my trust into the labels that the expert do assign things. There may be a weakness in the algorithm if the keys are reversed, that is not immediately obvious. If the thing we're protecting is worth protecting, it's worth doing it right...

Reply on news.ycombinator.com