Millions of High-Security Crypto Keys Crippled by Newly Discovered Flaw (arstechnica.com)

Slovak and Czech researchers have found a vulnerability that leaves government and corporate encryption cards vulnerable to hackers to impersonate key owners, inject malicious code into digitally signed software, and decrypt sensitive data, reports ArsTechnica. From the report: The weakness allows attackers to calculate the private portion of any vulnerable key using nothing more than the corresponding public portion. Hackers can then use the private key to impersonate key owners, decrypt sensitive data, sneak malicious code into digitally signed software, and bypass protections that prevent accessing or tampering with stolen PCs. The five-year-old flaw is also troubling because it's located in code that complies with two internationally recognized security certification standards that are binding on many governments, contractors, and companies around the world. The code library was developed by German chipmaker Infineon and has been generating weak keys since 2012 at the latest. The flaw is the one Estonia's government obliquely referred to last month when it warned that 750,000 digital IDs issued since 2014 were vulnerable to attack. Estonian officials said they were closing the ID card public key database to prevent abuse. On Monday, officials posted this update. Last week, Microsoft, Google, and Infineon all warned how the weakness can impair the protections built into TPM products that ironically enough are designed to give an additional measure of security to high-targeted individuals and organizations.

Comments

Re:vindicated

[hey!]

Next up, curve 25519 and millions of apple fan boys crying into their caramel latte.

If that happens, it won't just be Apple fan boys who are put out.

In any case, it doesn't take a math genius to predict something like this would happen with factorization. There was no breakthrough on the fundamental problem, only a discovery of a weak key choice algorithm. This is where nearly every exploit in the world comes from: not from advances in mathematics, but the discovery of sloppy implementations.

The problem with software is that it is almost irresistibly considered finished when it looks right.