Home » Posts tagged "prime"

ROCA:Infineon Technologies 的 RSA 實做問題

最近的另外一個大包,不過這包是 Infineon Technologies 在實做 RSA 算法時的問題,倒不是 RSA 算法本身有問題。之所以會「大」是因為有太多人用了:「ROCA: Vulnerable RSA generation (CVE-2017-15361)」。

起因於 Infineon Technologies 在產生 key 時的組合有限,於是要猜測的 keyspace 小很多。

以研究者的估算,可以看出 CPU year 都被大幅減少了,都是屬於「可行」的範圍:

The time complexity and cost for the selected key lengths (Intel E5-2650 v3@3GHz Q2/2014):

512 bit RSA keys - 2 CPU hours (the cost of $0.06);
1024 bit RSA keys – 97 CPU days (the cost of $40-$80);
2048 bit RSA keys – 140.8 CPU years, (the cost of $20,000 - $40,000).

而且這邊是用 CPU year 估算,如果考慮 FPGA 加速計算,應該會短更多...

另外從發現到公開的時間線也拉得很長,可以看到中間一直在找解決方案:

2nd of November 2017 - Presentation of all details at the ACM CCS conference (to come)
16th of October 2017 - The initial version of the public disclosure published
May to October 2017 - Cooperation with the manufacturer and other affected parties to help evaluate and mitigate the vulnerability
1st of February - The vulnerability disclosed to Infineon Technologies AG
End of January - The vulnerability found

過一陣子就會去 conference 上報告了...

Amazon 決定在自家的購物網站上停售 Google Chromecast 與 Apple TV

這大概是這幾天最刺激的事情... Amazon 決定在自家購物往站上停售 Google ChromecastApple TV:「Amazon to Ban Sale of Apple, Google Video-Streaming Devices」。

引用新聞的報導說明,因為 Chromecast 與 Apple TV 不相容於 Amazon 自家的 Prime Video,所以下令所有的店家停售:

The Seattle-based Web retailer sent an e-mail to its marketplace sellers that it will stop selling the Apple TV and Google’s Chromecast since those devices don’t "interact well" with Prime Video. No new listings for the products will be allowed and posting of existing inventory will be removed Oct. 29, Amazon said. Prime Video doesn’t run easily on its rival’s hardware.

至於會不會引起反壟斷調查呢?站在看好戲的立場當然是很希望,但這兩個產品就算不在 Amazon 上買,也有一卡車的競爭對手有賣... 不曉得後面會怎麼發展。

Amazon 在巴爾的摩與邁阿密推出「一個小時到貨」服務...

從「Amazon Launches One-Hour Delivery Service In Baltimore and Miami」這邊看到的,引用的報導是「Amazon launches one-hour delivery service in Baltimore」。

有付 Amazon Prime 費用的人在這兩個地區將提供兩小時到貨 (free),或是一小時到貨 (多收 USD$7.99):

The service will be available in select zip codes to Amazon Prime subscribers, who pay $99 a year for unlimited free two-day delivery on more than 20 million items. The one-hour service, available through the Prime Now mobile app, costs $7.99, while two-hour delivery will be free.

去年在曼哈頓的實驗算是成功吧... 只是 FAA 同意無人小型貨運機的實驗授權一下來就這樣公佈啊... (Amazon Gets Experimental Airworthiness Certificate)

Archives