Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

No.

First of all, primes are only used to arrive at a session key, and once you have a session key you're in the land of symmetric algorithms, which provide security by permutations rather than vectoring into prime spaces. The content of a web page does not matter at all in terms of the security being provided. A 404 is just as secure as a valid home page, in terms of cryptography. (Not in terms of application security, but that's a whole different thing.)

Second, the supply of prime numbers is countable but also infinite, and the relation between a number space and the number of primes within it is well established within the workable sizes. We have upper and lower bounds on the number of primes within certain ranges. This is partly why we end up with certain key sizes as being secure and other key sizes as being insufficient. Secure key sizes (in asymmetric algorithms) partly are secure because there are so many primes that can be fodder for key generation.



Well said.

A fun way to improve one's intuition for the huge space of primes in the regions that are used in cryptography is to run something like

openssl prime -generate -bits 1024

(This would give you one of two secret parameters for a 2048-bit RSA modulus.)

Here is an example output:

171512683213144641422165911053946068613736141364433791764418217818329805042681574174826781297743340609766353737741548521280185783254625590756752560896455821248403501924867464886010664489035275551178636464876794754383911750620888923620343965444339734253757757361106691647372710935609902417522529107877592063581

Not very easy to guess just because the space in question is limited to "1024-bit primes"!

And indeed, that's part of why we use primes that are this big when we still use RSA. They're big enough that the number of possibilities makes them not easy to guess (even given the extra hint of "the secret number you're looking for is one of the factors of this 2048-bit semiprime").

Exponentials are always hard for human intuition. We start with some kind of pattern and it feels like there just aren't that many numbers that would satisfy it. But when you get out to large numbers (even numbers as large as the one above), there just are that many numbers that would satisfy the pattern!


So in a replay attack all the communication is recorded including the session keys, and whilst primes are infinite dont dispute this, where the theory (human) and the practical (cpu's) differs is the limitations in the machine hardware, in much the same way Spectre and Meltdown exploited the hardware to obtain secrets.

The point about the webserver was using methods to work out what the underlying webserver and version was and potentially the OS, after all not much point trying to decrypt an algo that is not used on the webserver, but metadata is given out by many webservers to suggest what type of webserver it is.

And then there is education, we see people believe many things because this is what's taught to them, we see this cognitive dissonance with religious people but also in "educated" people like some GP's or academics because its their life's work and I'm sure cryptography has consumed many hours of people thinking things through, without much time spent on other areas of weakness like the limitations of a cpu and memory registers.

After all how many crypto experts are fully conversant with the inner workings of a CPU design? If they were conversant with CPU designs would Spectre and Meltdown have been found years earlier?

Admittedly side channel attacks but I did say in my original post "Whilst theory is different in practice due to machine limitations" and this is the thing is the current implementation of cryptography on devices suitable when considering the design of CPU's and devices?


Cryptanalysis is a pretty robust area of research. There are in fact a lot of cryptanalysts that know CPUs quite deeply. Certain organizations spend a great deal of money to make it so. If vulnerabilities are found we learn from them and advance the understanding of cryptography design. It has been that way for 76 years now, at least.


Not disputing what you say, but mistakes do happen to the best of us.

http://sunnyday.mit.edu/accidents/Ariane5accidentreport.html and yet again another OpenSSL bug , another flaw in the open source fallacy of many eyes to spot bugs... https://nakedsecurity.sophos.com/2021/03/28/serious-security...

plus when considering in maths there are ways to rearrange formulas including new discoveries like this one (a new way to do quadratic equations) https://news.ycombinator.com/item?id=29342161 https://www.sciencealert.com/math-genius-finally-discovers-e...

I wonder if discovering a new way to do things could be done to cryptographic algorithms.


You won't be the first, or the last, to wonder this. There are people who have dedicated entire lives to it.

Look into post quantum cryptography if you're interested to know about one of the big trains heading our way.


So using the basic definition of quantum computing being "a device which can compute all permutations at once", in theory yes it is a 0x73 0x68 0x69 0x74 0x20 0x73 0x74 0x6f 0x72 0x6d but thats because these algo's do not encompass time and a place.

Build time into an algo and then you need a quantum computer which can also roll back or forward time.

You see the problem is, how do you build time into an algorithm like a particle decay? And if you could, could you then make it like a time delayed bank vault which only opens for certain windows during the course of the particle decay?

I also wonder if a place, some co-ordinates could also be built into an algo if that is even possible. There are medieval examples, namely trusted couriers but then you are not looking so much at an algo but more a self contained device to defeat quantum computing.

Anyway for now, you've got the NSA data centre at Bluffdale Utah which can sort of replicate quantum computing by running multiple instances with each using one pwd from all the possible pwd combination to look for the magic bytes in a file https://en.wikipedia.org/wiki/List_of_file_signatures in order to decrypt files. A variation of that Could be used for replay attacks on network communication.

At least thats how I would do it quickly and easily.


That’s not how quantum computers work, but you’re on the right track. And yes, time is almost always an essential part of crypto algorithms (usually proving the order of things, e.g. when using nonces, or temporary keys to block re-generation as with ephemeral keys.)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: