Hacker News Reader

Comment by srcmap | Hacker News Reader

A related public key news:

https://arstechnica.com/information-technology/2017/10/crypt...

It compromises the TPM 1.2 and Microsoft Bitlocker HDD encruption.

The researchers also scanned the Internet for fingerprinted keys and quickly found hits in a variety of surprising places. They found 447 fingerprinted keys—237 of them factorizable—used to sign GitHub submissions, some for very popular software packages. GitHub has since been notified of the fingerprinted keys and is in the process of getting users to change them.

The researchers also found 2,892 PGP keys used for encrypted e-mail, 956 of which were factorizable. The researchers speculated that the majority of the PGP keys were generated using the Yubikey 4, which allows owners to use the faulty library to create on-chip RSA keys. Other functions of the USB device, including U2F authentication, remain unaffected. Yubico has more details here.

View on HN

What are the odds that this was intentional? TPM and Bitlocker have been two of the biggest conjectured targets of compromise. To the point that most security people/libraries use neither. Maybe they were right?

If this is true one of Stackoverflow comments is quite chilling

It would be a terrible idea and it would raise suspicions of a deliberate trapdoor if the primes for RSA were chosen from a quadratic progression rather than randomly

> If this is true one of Stackoverflow comments is quite chilling

MathOverflow?

Haha same difference. Mathoverflow is just a lot more hardcore :)

That comment isn't intended to be "chilling"; it's intended to be the opposite.

This is a terrible cryptographic backdoor. If you're going to backdoor cryptography, you do it cryptographically, so that only you and your partners can decrypt it (this is called a "NOBUS" backdoor, for "nobody but us"). The only reason nobody found the Infineon bug already is that nobody seriously looked for it.

The most plausible explanation for the Infineon bug is also the most widespread: there's prime number generation advice for quickly generating primes on low-power devices like smartcards, and that advice was badly flawed.

(This isn't the first time primegen bugs have created factorable public keys in the wild; Henninger has a similar attack relating to p = randomprime(start=0), q = randomprime(start=p)).

If you could introduce a bias in implementations to generate primes of the form more often than random then it could be useful, right?

I'm not wearing my tin foil hat so I realize that in order to do that in the first place you'd probably already have enough influence to do much more than this. But just for the sake of a hypothetical...

There are backdoors you can introduce from that position that don't involve an n * 2^-700 probability of the pattern occurring non-maliciously.

Do tell...

I've looked through the source of several common RSA keygen implementations and noticed that there usually aren't many sanity checks afterwards.

But I've never really thought about what can go wrong there (by random chance or by exploit).

/me puts on tin foil hat ... what could the lizard people plant in there?

Don your shiny crinkly hats, but after https://en.m.wikipedia.org/wiki/Dual_EC_DRBG I started believing that NSA involvement is not subtle in their exploits.

They only need to fool laymen, and backdoored primes are an easy way to do so. The number of true cryptography experts beyond their walls is a dozen in the world at best. Case in point https://en.m.wikipedia.org/wiki/Daniel_J._Bernstein . And BTW he's been sued by the US government for ???. Thank God the EFF has decent funding.

"The number of true cryptography experts beyond [the walls of the NSA] is a dozen in the world at best"?

This kind of logic is super common on HN threads and it's incoherent. If the expertise and capabilities of the NSA with respect to basic cryptographic mathematics is so unknowable that thousands of published academic cryptographers are wasting their time, then what makes you think a random amateur Math Overflow post has somehow stumbled on a deep secret of NSA RSA subterfuge?

For whatever it's worth to you, Dan Bernstein was not sued by the US Government. Dan Bernstein sued the US Government, over export restrictions on cryptography in the 1990s; his suit was mooted by the relaxation of those restrictions.

NSA made seemingly bening improvements to crypto standards that the academic community only discovered as valuable over a decade later.

They’re the largest single employer of mathmaticians in the world.

> NSA made seemingly bening improvements to crypto standards that the academic community only discovered as valuable over a decade later.

At the same time, they negotiated DES's key length down. It was 64 bits originally, the NSA wanted only 48 bits, IBM and the NSA compromised on 56 bits.

Note that the Dual EC DRBG backdoor you point to was in fact a NOBUS backdoor.

Do you honestly believe that China and Russia don't take cryptography seriously, and between them only employ a tiny handful of experts...?

The opposite. Government entities suck up all the world's crypto experts leaving very few working in the publics interest.

You mean except for every professor, postdoc, and grad student working in every crypto research group at every large CS department in the world?

The recent Infineon weakness is not a flaw in TPMs in general or Bitlocker. This is a flaw related to certain TPMs, and is only applicable to Bitlocker if you used those affected TPMs with Bitlocker. FWIW, this same flaw could relate to PGP keys generated with the affected TPMs. This same flaw was related to PIVs issued on Estonian IDs, which I doubt are commonly used for Bitlocker.

More on the actual ROCA vulnerability for anyone curious:

https://crocs.fi.muni.cz/public/papers/rsa_ccs17

https://crypto.stackexchange.com/questions/52292/what-is-fas...

is there a reason why bitlocker would use rsa for encryption? afaik how bitlocker worked with tpm was that it would generate a (symmetric) key, store it in the tpm, then seal it, binding it to the current PCR value. on boot, it would unseal it (which will succeed unless the PCR changed).

It doesn't. Intel-compatible TPMs do, and Bitlocker will take advantage of those to get a hardware root of trust for the volume master key. Without it, it'll use AES.

The aes key is encrypted using an rsa key that was generated on the TPM - the TPM PCR values need to be valid for the TPM to decrypt and release the decrypted aes key.

Wait. My Yubikey 4-generated let's might be bunk? How can I check this?

Reply on news.ycombinator.com