How is NSA breaking into VPNs?
Peter Fairbrother
zenadsl6186 at zen.co.uk
Fri Oct 16 23:41:03 BST 2015
On 16/10/15 17:29, Brian Gladman wrote:
> An interesting paper on the weaknesses of DH key exchange protocols:
>
> https://weakdh.org/imperfect-forward-secrecy-ccs15.pdf
The paper describes the Logjam attack, and the state-level attacks on
shared DH primes.
Logjam, like FREAK, degrades crypto suite choices, in this case TLS DH
to 512-bit "export grade" crypto. It's a bit more sophisticated than
FREAK, but not much.
7th principle: Holes for "good guys" are holes for bad guys too.
8th principle: In code, nothing ever really goes away.
(big nod to Jerry Leichter)
More controversial, and quite possibly more damaging, is this:
"Threats from state-level adversaries.
Millions of HTTPS, SSH, and VPN servers all use the same prime numbers
for Diffie-Hellman key exchange. Practitioners believed this was safe as
long as new key exchange messages were generated for every connection.
However, the first step in the number field sieve — the most efficient
algorithm for breaking a Diffie-Hellman connection — is dependent only
on this prime. After this first step, an attacker can quickly break
individual connections.
[...]
A close reading of published NSA leaks shows that the agency's attacks
on VPNs are consistent with having achieved a break [of the single, most
common 1024-bit prime]."
I wonder whether the "state level threat" of breaking common 1024-bit DH
primes is the "major breakthrough" which NSA told Congress about a few
years ago, for which they got all that lovely extra money.
If so, the people who in 2013 were supporting the idea of replacing
2048-bit RSA with ubiquitous 1024-bit DH in order to provide FS look a
bit silly ..
[ the major browsers supported only 1024-bit DH, but supported 2048-bit
RSA, perhaps due to people mistakenly thinking that DH keys needed to be
half the size of RSA keys - it might be interesting to see where that
rumour came from.
To quote Peter Gutmann, posting on the cryptography at metzdowd list:
"It's a debate between two groups, the security practitioners, "we'd
like a PFS solution as soon as we can, and given currently-deployed
infrastructure DH-1024 seems to be the best bet", and the theoreticians,
"only a theoretically perfect solution is acceptable, even if it takes
us forever to get it"."
By the way, this was just after Snowden, when Google and the like were
moving to ubiquitous 2048-bit RSA, and supposedly crypto people were
running around like headless chickens saying "we must do something".
NSA must have been laughing all the way to the bank. ]
-- Peter Fairbrother
More information about the ukcrypto
mailing list