转载

在攻擊時總是挑最弱的一環：NSA 對 DH 的攻擊

在「 How is NSA breaking so much crypto? 」這邊提到了 2012 年有文章說明 NSA 有能力解開部份的加密通訊，而後來 Snowden 所提供的資料也證實了這點：

In 2012, James Bamford published an article quoting anonymous former NSA officials stating that the agency had achieved a “computing breakthrough” that gave them “the ability to crack current public encryption.” The Snowden documents also hint at some extraordinary capabilities: they show that NSA has built extensive infrastructure to intercept and decrypt VPN traffic and suggest that the agency can decrypt at least some HTTPS and SSH connections on demand.

但在這之前一直都不清楚是怎麼解出來的，直到最近才猜測應該是 Diffie-Hellman 的強度以及實作問題：「 Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice 」。

而成果其實非常驚人，由於強度不夠以及實作問題，有相當可觀的數量是可被攻擊的：

We go on to consider Diffie-Hellman with 768- and 1024-bit groups. We estimate that even in the 1024-bit case, the computations are plausible given nation-state resources. A small number of fixed or standardized groups are used by millions of servers; performing precomputation for a single 1024-bit group would allow passive eavesdropping on 18% of popular HTTPS sites, and a second group would allow decryption of traffic to 66% of IPsec VPNs and 26% of SSH servers. A close reading of published NSA leaks shows that the agency’s attacks on VPNs are consistent with having achieved such a break. We conclude that moving to stronger key exchange methods should be a priority for the Internet community.

作者群給的建議有三個方向，一個是把長度加長到 2048 bits，另外一個是改用 ECDH ，而最差的情況 (如果還是需要使用 1024 bits DH) 則是避免使用固定的 prime number。

正文到此结束