Slashdot Mirror

← Back to Stories (view on slashdot.org)

Researchers Find Same RSA Encryption Key Used 28,000 Times

Posted by timothy on from the well-if-it-workef-for-that-guy dept.

itwbennett writes In the course of trying to find out how many servers and devices are still vulnerable to the Web security flaw known as FREAK, researchers at Royal Holloway of the University of London found something else of interest: Many hosts (either servers or other Internet-connected devices) share the same 512-bit public key. In one egregious example, 28,394 routers running a SSL VPN module all use the same 512-bit public RSA key.

4 of 132 comments (clear)

  1. I imagine .... by PPH · · Score: 4, Insightful

    ... some vendor built a router or server up to the point of generating the public/private key pair, tested it, saved the image and started copying it to production units.

    Similar mistake have been made before.

    --
    Have gnu, will travel.
  2. Re:Know what's worse? Cleartext. by msauve · · Score: 4, Insightful

    I suspect his problem with it is that he confuses it with WEP.

    --
    "National Security is the chief cause of national insecurity." - Celine's First Law
  3. Re:Know what's worse? Cleartext. by chrysosphinx · · Score: 5, Insightful

    Weak, bad or fake encryption is infinitely much worse than none, because it makes people believe they are safe while they are not.

  4. Re:Know what's worse? Cleartext. by TechyImmigrant · · Score: 4, Insightful

    You are talking about breaking passwords, not the encryption scheme, which comes later.

    Password -> PMK -> 4 way handshake (session key establishment) -> Authenticated encryption (link cipher).

    A 12 character, alphanumeric + special character password, uniformly generated is about 70 bits of entropy. The pbkdf2 invocation to generate the PMK has 4096 iterations, causing the brute force attack to need to perform on average ~ 2^81 hashes before finding a password. This would not happen over lunch.

    Did your friend's tool actually break WEP instead of WPA-2? Or did you have a weak password? Or were you using a weak EAP method? Or what other form of BS are you talking?

    --
    I should use this sig to advertise my book ISBN-13 : 978-1501515132.