|
|
Subscribe / Log in / New account

Millions of high-security crypto keys crippled by newly discovered flaw (Ars Technica)

Millions of high-security crypto keys crippled by newly discovered flaw (Ars Technica)

Posted Oct 17, 2017 16:27 UTC (Tue) by tialaramex (subscriber, #21167)
Parent article: Millions of high-security crypto keys crippled by newly discovered flaw (Ars Technica)

Possible smoking gun? https://www.google.com/patents/DE10357751A1

I can't read German and the translation (?) is mangled sufficiently badly that it casts almost as much shadow as light, but this is clearly a Fast Primality invention, patented by Infineon in the right period. The "invention" is a technique for picking several prime numbers but sharing the work so that effort expended isn't proportional to the number of primes found. The confusing language combined with my lack of specialist knowledge [I know roughly what Miller-Rabin is, but I couldn't implement it without a proper explanation to crib from] means I don't know exactly how they do this, but it's pretty obvious that a good RSA private key has primes p, q unrelated except for the fact that they're roughly the same size. Two primes produced in the manner described are surely related and thus unsuitable for a private key.

Am I wrong? Is it somehow OK to have an algorithm that picks related primes and then use them for p, q ?

The ROCA site is adamant that this isn't just "smart cards have crappy RNGs" again, and indeed they go out of their way to say the chips don't have a problem (so far as they know) for ECC key generation where the same card offers both. That puts the code for picking primes square in the focus, because that's one of the few things you could get wrong and not notice if the RNGs work and your adjacent ECC key generator works too.


to post comments


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds