Comment by rgbrenner | Hacker News Reader

Comment by rgbrenner | Hacker News Reader

If you follow the links, you'll end up here: https://www.usenix.org/conference/usenixsecurity16/technical...

Can bits of an RSA public key leak information about design and implementation choices such as the prime generation algorithm? We analysed over 60 million freshly generated key pairs from 22 open- and closedsource libraries and from 16 different smartcards, revealing significant leakage. The bias introduced by different choices is sufficiently large to classify a probable library or smartcard with high accuracy based only on the values of public keys. Such a classification can be used to decrease the anonymity set of users of anonymous mailers or operators of linked Tor hidden services, to quickly detect keys from the same vulnerable library or to verify a claim of use of secure hardware by a remote party.

I found the original page hard to read. Reading the abstract of the paper cleared all the confusion.

Right. The paper is much better than the PR.

It's not clear there's a real security problem here in being able to identify the prime generator for RSA keys. Unless that generator is weaker than it should be. They did find at least two key generators which look suspicious. One generator never generates certain byte combinations, which indicates a possible serious weakness in the random number generation.

Weak RSA key generators have been found in the past. Big flap back in 2012.[1] Some keys were found which were products of two large primes where two keys shared the one factor. This is hugely unlikely statistically; the generator had to be defective. This isn't that bad.

The real worry, of course, is a designed-in weakness in the random number generator, one that's not detectable by the usual statistical tests.

[1] http://arstechnica.com/business/2012/02/crypto-shocker-four-...

> If you follow the links, you'll end up here: https://www.usenix.org/conference/usenixsecurity16/technical...

and just to add, the paper itself and a video of the author's presentation are available at this page.

dang could we update the link? This is a much more solid source.

Allegedly there is an extended version of the paper here: http://crcs.cz/rsa But the site is not responding and archive.org has no information either.

Reply on news.ycombinator.com