home.social

Search

6 results for “sophieschmieg”

  1. Cliff Barbier @cliffb_infosec

    RE: infosec.exchange/@sophieschmie

    When I did security assessments in banks, my favorite thing to do was the physical building —An outdoor stroll with the client on their site and building perimeters. In about 15% of cases I'd come across a non-primary outside door. The client would say "oh, no one goes in there, it's always locked". Then I'd turn the knob and pull open the door. After the client retrieved their jaw from the ground and re-attached it, they'd stammer and I'd point out that this was my job: Bring a pair of fresh eyes and validate their assumptions.

    Coming from an background, it is amazing to me what even some security people think of as "validation". In highly sensitive environments (my previous work with credit file systems), I don't make any assumptions.

    "XYZ is prevented"? Great. Test it. I don't care that it is pointless to test it, create an automated, periodic test and test it. If our security RELIES on XYZ being prevented, it is (yes, I said the corporate N word) to not test it.

    I'm not picking on @sophieschmieg here—it appears that no one validated the key choices of upstream CAs.

    The question is: How many OTHER assumptions have been made in your tools, in your org, in the global security systems we rely on?

    #walkaround #audit #negligent
  2. Sophie Schmieg @sophieschmieg

    People are asking how long it would take to brute force the infamous 4 key by hand.

    Let's do the math.
    The first decision is whether we want to use 115 digit decimal numbers or 96 digit hex numbers. Hex is less familiar, but we'll have to do a lot of computation modulo 2³⁸⁴-2¹²⁸-2⁹⁶+2³²-1. In hex that's just adding/subtracting four numbers (possibly a few times, but not too much), in decimal it's…not that.

    Next, let's see what we need for a single point addition:
    We first need to compute either X²-3/2Y or (Y1-Y2)/(X2-X2) for the slope.
    The -3 is a parameter from the curve spec, and the only time the spec is going to be nice to us.
    This is an inversion modulo p. We can use the extended euclidian algorithm for that (your computer will do a more expensive operation when handling private key material, as the euclidean algorithm isn't constant time)

    The Euclidean algorithm requires ~log2(x) iterations. Unfortunately, in the P384 spec, the generator is just a random point, so this log2 is 384. 384 divisions with remainder, followed by multiplications. The numbers will get smaller, but long division is quadratic, so that's roughly 384*(384+1)*(2*384+1)/6 / 16 ~ 1 million hex digit operations, for one inversion. You'll also need to multiply in each step, so I think you end up with something like 2 million hex ops per inversion.

    The rest of the equation is negligible, just a few multiplications and additions, which will drown in the noise of my ballpark estimate.

    Doing this four times gets you ~8 million hex operations.

    At one hex operation per second, that's 2.5 years of non stop computation.

    Meanwhile a computer does 3 billion 64 bit word operations per second. It takes a few milliseconds.

    You could shave a couple of operations by not using long division, and switch to Toom–Cook, but you'll still be busy for quite some time.

  3. Sophie Schmieg @sophieschmieg

    XKCD now has an official statement about the whole situation: please upgrade to 5 as your private key.

    m.xkcd.com/

  4. Sophie Schmieg @sophieschmieg

    And now I'm hearing that the original researcher found it via a Google tool called Paranoid. We actually run that tool on leaf certificates with some regularity. I guess we just didn't consider to run it on roots…

    groups.google.com/a/mozilla.or

  5. Sophie Schmieg @sophieschmieg

    This press release is gold:

    emudhra.com/en/press-release/e

    "Last weekend, an independent researcher found that the weak keys could be reverse-engineered possibly with AI-assisted techniques."

    Your private key was the number 4. Your fucking private key, which is supposed to be a 115 digit number, was the fucking number 4. As in, the fourth key a very naive first analysis would try. But sure scary scary AI did it.

    I independently recovered the private key, without any AI assistance, on Monday evening. Not because I was involved in the incident, just because I was curious and had a little bit of free time on my hand.

  6. David Culley @davidculley

    RE: infosec.exchange/@sophieschmie

    With sentences like these, companies erase all remaining trust in them:

    > "Last weekend, an independent researcher found that the weak keys could be reverse-engineered possibly with AI-assisted techniques."

Share on Mastodon

Enter the server where you have an account.