How to defend from an attacker armed with a mathematician
summary
OpenSSL implementation combines three small issues that together let an attacker recover a server private key: DH public values are reused instead of ephemeral, client-supplied public keys aren’t validated, and the chosen primes have p−1 with many small factors so they’re weak primes with smooth p−1. Exploit uses number theory (factorization of p−1, Chinese Remainder Theorem) to reconstruct the secret from repeated nonces and it successfully extracts the private key.
AI-written summary · about
related talks
42mRecover a RSA Private Key From a TLS Session With Perfect Forward Secrecy
28mOne&Done: A Single-Decryption EM-Based Attack on OpenSSL’s Constant-Time Blinded RSA
51mA Retrospective on the Use of Export Cryptography
01h 13mHow Diffie-Hellman Fails in Practice
55mUnlocking The Secrets Of TLS
29mHow Prime Numbers Keep the Internet Secure
44mCryptography Pitfalls
44mThe DROWN Attack