Researchers broke RSA 1024-bit encryption

RSA 1024-bit - is it safe? Security researchers have discovered a critical vulnerability in the GnuPG cryptographic library that allowed them to crack 1024 bit RSA encryption and extract the secret RSA key to decrypt data.

Το Gnu Privacy Guard (GnuPG ή GPG) είναι ένα δημοφιλές λογισμικό κρυπτογράφησης ανοικτού κώδικα που χρησιμοποιείται από πολλά λειτουργικά συστήματα (Linux, FreeBSD , and macOS X).RSA 1024-bit

Vulnerability, under the name CVE-2017-7526, is located in the Libgcrypt encryption library used by GnuPG.

It's the same software that the former NSA employee used Edward Snowden to encrypt his communications.

The research

Μια ομάδα ερευνητών από τα Πανεπιστήμια, Eindhoven, Illinois, Pennsylvania, Maryland, και Adelaide, διαπίστωσαν ότι η μέθοδος “left-to-right sliding window” που χρησιμοποιείται από τη βιβλιοθήκη libgcrypt για τη διεξαγωγή των of s leaks significantly more information than is needed, allowing the full recovery of the RSA key.

"In this work, we demonstrate a complete breakdown of RSA-1024 as applied to Libgcrypt. Our attack basically uses the fact that Libgcrypt uses the left-to-right method to calculate the sliding-window extension“, αναφέρουν οι στο paper τους.

The L3 Cache Side-Channel attack requires an attacker to run "tampered" software on the hardware using the RSA private key.

For more information read 'Sliding right into disaster: Left-to-right sliding windows leak,' (PDF) of J. Bernstein, Joachim Breitner, Daniel Genkin, Leon Groot Bruinderink, Nadia Heninger, Christine van Vredendaal, Tanja Lange and Yuval Yarom.

iGuRu.gr The Best Technology Site in Greecefgns

every publication, directly to your inbox

Join the 2.100 registrants.

Written by giorgos

George still wonders what he's doing here ...

Leave a reply

Your email address is not published. Required fields are mentioned with *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).