Tag Archives: rsa

IBM 的 50 qubit quantum computer

IBM 在展示他們做到了什麼:「IBM makes 20 qubit quantum computing machine available as a cloud service」。 不過重點應該在目前已經拉出 50 qubit prototype 了: The company also announced that IBM researchers had successfully built a 50 qubit prototype, which is the next milestone for quantum computing, … Continue reading

Posted in Cloud, Computer, Murmuring, Network, Programming, Science, Security, Service|Tagged , , , , , , |Leave a comment

ROCA:Infineon Technologies 的 RSA 實做問題

最近的另外一個大包,不過這包是 Infineon Technologies 在實做 RSA 算法時的問題,倒不是 RSA 算法本身有問題。之所以會「大」是因為有太多人用了:「ROCA: Vulnerable RSA generation (CVE-2017-15361)」。 起因於 Infineon Technologies 在產生 key 時的組合有限,於是要猜測的 keyspace 小很多。 以研究者的估算,可以看出 CPU year 都被大幅減少了,都是屬於「可行」的範圍: The time complexity and cost for the selected key lengths (Intel E5-2650 v3@3GHz Q2/2014): 512 bit … Continue reading

Posted in Computer, Murmuring, Privacy, Security|Tagged , , , , , , , , , , |Leave a comment

Gmail 要開始導入 SMTP Strict Transport Security 了

SMTP MTA Strict Transport Security 算是 SMTP STARTTLS 裡的 HSTS 機制,而 Google 的人在 RSA Conference 上提出要開始用了:「SMTP STS Coming Soon to Gmail, Other Webmail Providers」。 Elie Bursztein, the head of Google’s anti-abuse research team, said at RSA Conference that SMTP STS … Continue reading

Posted in Computer, Mail, Murmuring, Network, Security, Spam|Tagged , , , , , , , , , , |Leave a comment

Let's Encrypt 支援 IDN

Let's Encrypt 宣佈支援 IDN:「Introducing Internationalized Domain Name (IDN) Support」,這代表可以申請的範圍變得更廣了: This means that our users around the world can now get free Let’s Encrypt certificates for domains containing characters outside of the ASCII set, which is built primarily for the English … Continue reading

Posted in Computer, DNS, Murmuring, Network, Security, WWW|Tagged , , , , , , , , , , , , |Leave a comment

Google Chrome 引入 CECPQ1,開始測試 Post-Quantum Cryptography

Quantum Computer 對現有密碼學的衝擊很大,像是 RSA 演算法是基於「質因數分解」的難題而架構出來的系統,在 Quantum Computer 上存在有效率的演算法,也就是 Shor's algorithm。 雖然 Quantum Computer 在技術上還沒辦法對現有演算法造成有效的攻擊,但已經有人提出新的演算法來對抗,而 Google 打算在 Google Chrome 裡面引入測試:「Experimenting with Post-Quantum Cryptography」。 Google 也特別說明了,他們不希望這個實驗最後變成 de-facto standard (借測轉出貨的概念),而是希望當作一個開頭,希望之後可以用更好的標準換掉: We explicitly do not wish to make our selected post-quantum algorithm a de-facto … Continue reading

Posted in Browser, Computer, GoogleChrome, Murmuring, Network, Security, Software, WWW|Tagged , , , , , , , |2 Comments

密碼系統的 Monoculture

這篇文章講到最近密碼系統的現象:「On the Impending Crypto Monoculture」。 目前常在用的密碼系統包括了 RSA、DH、ECDH、ECDSA、SHA-2、AES 這些演算法,而最近這幾年大家在推廣使用的演算法都出自於同一個人手裡,Dan Bernstein,也就是 djb: A major feature of these changes includes the dropping of traditional encryption algorithms and mechanisms like RSA, DH, ECDH/ECDSA, SHA-2, and AES, for a completely different set of mechanisms, including … Continue reading

Posted in Computer, Murmuring, Security|Tagged , , , , , , , , , , , , , , , , , , , , , , , , , , , |1 Comment

USD$75 解 RSA 512bits

Cryptology ePrint Archive 上面剛好是 2015 年編號 1000 號的論文:「Factoring as a Service」。透過 Amazon EC2 服務以及 CADO-NFS 的幫助,四小時內就可以解出 512bits RSA,而如同作者說的,雖然已經很不安全了,但在許多地方仍然被使用著: The difficulty of integer factorization is fundamental to modern cryptographic security using RSA encryption and signatures. Although a 512-bit RSA modulus was … Continue reading

Posted in AWS, Cloud, Computer, DNS, Murmuring, Network, Security|Tagged , , , , , , , , , |Leave a comment

Let's Encrypt 建立 Root Certificate 與 Intermediate Certificate

Let's Encrypt 的 Root Certificate 與 Intermediate Certificate 建出來了:「Let's Encrypt Root and Intermediate Certificates」。 Intermediate Certificate 除了會讓自己的 Root Certificate 簽名外,也會讓 IdenTrust 的 DST Root CA X3 簽 (目前各大瀏覽器與 SSL library 都有支援)。 目前是 RSA key,之後會生出 ECDSA key: All ISRG keys are … Continue reading

Posted in Computer, Murmuring, Network, Security, WWW|Tagged , , , , , , , , , , , , |Leave a comment

對 GitHub 的 Public Key 分析

在 Hacker News Daily 上看到有人針對 GitHub 上的 Public Key 分析:「Auditing GitHub users’ SSH key quality」。 這個分析主要用的是 GitHub 的 .keys 功能取得: A little known feature of GitHub is the ability to look at the public SSH keys that other users have … Continue reading

Posted in Computer, Murmuring, Network, Security|Tagged , , , , , , , |Leave a comment

CloudFlare 對 Go 上面加解密系統的改善

CloudFlare 發佈了自己版本的 Go,修改了其中的 crypto subsystem:「Go crypto: bridging the performance gap」。 文章花了不少篇幅介紹 AEAD (Authenticated Encryption with Associated Data),而目前 CloudFlare 支援的是 AES-GCM 與 ChaCha20-Poly1305,也是兩大主流,分別佔了 60% 與 10% 的 HTTPS 流量: As such today more than 60% of our client facing traffic is … Continue reading

Posted in CDN, Cloud, Computer, Murmuring, Network, Programming, Security, Software|Tagged , , , , , , , , , , , , , , |Leave a comment