Slashdot Mirror

← Back to Stories (view on slashdot.org)

Researchers Find Same RSA Encryption Key Used 28,000 Times

Posted by timothy on from the well-if-it-workef-for-that-guy dept.

itwbennett writes In the course of trying to find out how many servers and devices are still vulnerable to the Web security flaw known as FREAK, researchers at Royal Holloway of the University of London found something else of interest: Many hosts (either servers or other Internet-connected devices) share the same 512-bit public key. In one egregious example, 28,394 routers running a SSL VPN module all use the same 512-bit public RSA key.

8 of 132 comments (clear)

  1. Know what's worse? Cleartext. by Iamthecheese · · Score: 3, Insightful

    This is a real problem and I don't mean to minimize it. But weak encryption is infinitely better than none, and the solution to this is immensely easier than the solution to the many, many wholly unencrypted connections that are happening this very moment. I think we should prioritize getting all connections everywhere encrypted somehow.

    --
    If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
    1. Re:Know what's worse? Cleartext. by msauve · · Score: 4, Insightful

      I suspect his problem with it is that he confuses it with WEP.

      --
      "National Security is the chief cause of national insecurity." - Celine's First Law
    2. Re:Know what's worse? Cleartext. by chrysosphinx · · Score: 5, Insightful

      Weak, bad or fake encryption is infinitely much worse than none, because it makes people believe they are safe while they are not.

    3. Re:Know what's worse? Cleartext. by TechyImmigrant · · Score: 4, Insightful

      You are talking about breaking passwords, not the encryption scheme, which comes later.

      Password -> PMK -> 4 way handshake (session key establishment) -> Authenticated encryption (link cipher).

      A 12 character, alphanumeric + special character password, uniformly generated is about 70 bits of entropy. The pbkdf2 invocation to generate the PMK has 4096 iterations, causing the brute force attack to need to perform on average ~ 2^81 hashes before finding a password. This would not happen over lunch.

      Did your friend's tool actually break WEP instead of WPA-2? Or did you have a weak password? Or were you using a weak EAP method? Or what other form of BS are you talking?

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    4. Re:Know what's worse? Cleartext. by Ginger+Unicorn · · Score: 3, Insightful

      Weak or bad encryption is not worse in the situation where the person doesn't care if they're safe, or isn't even aware that there's a safety issue. Which is the vast majority of the time.

      --
      (1.21 gigawatts) / (88 miles per hour) = 30 757 874 newtons
  2. I imagine .... by PPH · · Score: 4, Insightful

    ... some vendor built a router or server up to the point of generating the public/private key pair, tested it, saved the image and started copying it to production units.

    Similar mistake have been made before.

    --
    Have gnu, will travel.
  3. Re:Poor first sentence by bobbied · · Score: 3, Insightful

    So having a lock really is an advantage... Well, actually it doesn't matter to a thief anyway.

    I once had the window broken in my car so they could steal my wife's purse... The doors where unlocked, but they broke the window anyway.

    I guess the issue here is that the "key" is easily changed in this case. You don't need to have the guy at the home improvement store rekey it for you...

    --
    "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
  4. Re:Poor first sentence by Lumpy · · Score: 1, Insightful

    Yup, most popular locks on homes have a very very limited number of key combinations.

    Cars are worse. It's not uncommon to find another car that your key can unlock.

    --
    Do not look at laser with remaining good eye.