The Million-Key Question – Investigating the Origins of RSA Public Keys

Logo poskytovatele

Varování

Publikace nespadá pod Ekonomicko-správní fakultu, ale pod Fakultu informatiky. Oficiální stránka publikace je na webu muni.cz.
Autoři

ŠVENDA Petr NEMEC Matúš SEKAN Peter KVAŠŇOVSKÝ Rudolf FORMÁNEK David KOMÁREK David MATYÁŠ Václav

Rok publikování 2016
Druh Článek ve sborníku
Konference Proceedings of 25th USENIX Security Symposium
Fakulta / Pracoviště MU

Fakulta informatiky

Citace
www https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/svenda
Obor Informatika
Klíčová slova rsa; fingerprinting; cryptographic library; side-channel analysis
Popis Can bits of an RSA public key leak information about design and implementation choices such as the prime generation algorithm? We analysed over 60 million freshly generated key pairs from 22 open- and closedsource libraries and from 16 different smartcards, revealing significant leakage. The bias introduced by different choices is sufficiently large to classify a probable library or smartcard with high accuracy based only on the values of public keys. Such a classification can be used to decrease the anonymity set of users of anonymous mailers or operators of linked Tor hidden services, to quickly detect keys from the same vulnerable library or to verify a claim of use of secure hardware by a remote party. The classification of the key origins of more than 10 million RSA-based IPv4 TLS keys and 1.4 million PGP keys also provides an independent estimation of the libraries that are most commonly used to generate the keys found on the Internet. Our broad inspection provides a sanity check and deep insight regarding which of the recommendations for RSA key pair generation are followed in practice, including closed-source libraries and smartcards.
Související projekty:

Používáte starou verzi internetového prohlížeče. Doporučujeme aktualizovat Váš prohlížeč na nejnovější verzi.