The Million-Key Question – Investigating the Origins of RSA
Public Keys

D 2016

The Million-Key Question – Investigating the Origins of RSA Public Keys

ŠVENDA, Petr, Matúš NEMEC, Peter SEKAN, Rudolf KVAŠŇOVSKÝ, David FORMÁNEK et. al.

Základní údaje

Originální název

The Million-Key Question – Investigating the Origins of RSA Public Keys

Autoři

ŠVENDA, Petr (203 Česká republika, garant, domácí), Matúš NEMEC (703 Slovensko, domácí), Peter SEKAN (703 Slovensko, domácí), Rudolf KVAŠŇOVSKÝ (703 Slovensko, domácí), David FORMÁNEK (203 Česká republika, domácí), David KOMÁREK (203 Česká republika, domácí) a Václav MATYÁŠ (203 Česká republika, domácí)

Vydání

Austin, Texas, Proceedings of 25th USENIX Security Symposium, od s. 893-910, 18 s. 2016

Nakladatel

USENIX Association

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

10201 Computer sciences, information science, bioinformatics

Stát vydavatele

Spojené státy

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

elektronická verze "online"

Odkazy

URL

Kód RIV

RIV/00216224:14330/16:00088076

Organizační jednotka

Fakulta informatiky

ISBN

978-1-931971-32-4

UT WoS

000385263000053

Klíčová slova anglicky

rsa; fingerprinting; cryptographic library; side-channel analysis

Štítky

core_A, firank_1

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 14. 5. 2020 15:18, RNDr. Pavel Šmerk, Ph.D.

Anotace

V originále

Can bits of an RSA public key leak information about design and implementation choices such as the prime generation algorithm? We analysed over 60 million freshly generated key pairs from 22 open- and closedsource libraries and from 16 different smartcards, revealing significant leakage. The bias introduced by different choices is sufficiently large to classify a probable library or smartcard with high accuracy based only on the values of public keys. Such a classification can be used to decrease the anonymity set of users of anonymous mailers or operators of linked Tor hidden services, to quickly detect keys from the same vulnerable library or to verify a claim of use of secure hardware by a remote party. The classification of the key origins of more than 10 million RSA-based IPv4 TLS keys and 1.4 million PGP keys also provides an independent estimation of the libraries that are most commonly used to generate the keys found on the Internet. Our broad inspection provides a sanity check and deep insight regarding which of the recommendations for RSA key pair generation are followed in practice, including closed-source libraries and smartcards.

Návaznosti

GA16-08565S, projekt VaV

Název: Rozvoj kryptoanalytických metod prostřednictvím evolučních výpočtů

Investor: Grantová agentura ČR, Advancing cryptanalytic methods through evolutionary computing

MUNI/A/0935/2015, interní kód MU

Název: Zapojení studentů Fakulty informatiky do mezinárodní vědecké komunity (Akronym: SKOMU)

Investor: Masarykova univerzita, Zapojení studentů Fakulty informatiky do mezinárodní vědecké komunity, DO R. 2020_Kategorie A - Specifický výzkum - Studentské výzkumné projekty

Citovat

ŠVENDA, Petr, Matúš NEMEC, Peter SEKAN, Rudolf KVAŠŇOVSKÝ, David FORMÁNEK, David KOMÁREK a Václav MATYÁŠ. The Million-Key Question – Investigating the Origins of RSA Public Keys. Online. In Thorsten Holz, Stefan Savage. Proceedings of 25th USENIX Security Symposium. Austin, Texas: USENIX Association, 2016, s. 893-910. ISBN 978-1-931971-32-4.

@inproceedings{1351380,
   author = {Švenda, Petr and Nemec, Matúš and Sekan, Peter and Kvašňovský, Rudolf and Formánek, David and Komárek, David and Matyáš, Václav},
   address = {Austin, Texas},
   booktitle = {Proceedings of 25th USENIX Security Symposium},
   editor = {Thorsten Holz, Stefan Savage},
   keywords = {rsa; fingerprinting; cryptographic library; side-channel analysis},
   howpublished = {elektronická verze "online"},
   language = {eng},
   location = {Austin, Texas},
   isbn = {978-1-931971-32-4},
   pages = {893-910},
   publisher = {USENIX Association},
   title = {The Million-Key Question – Investigating the Origins of RSA Public Keys},
   url = {https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/svenda},
   year = {2016}
}

TY  - JOUR
ID  - 1351380
AU  - Švenda, Petr - Nemec, Matúš - Sekan, Peter - Kvašňovský, Rudolf - Formánek, David - Komárek, David - Matyáš, Václav
PY  - 2016
TI  - The Million-Key Question – Investigating the Origins of RSA Public Keys
PB  - USENIX Association
CY  - Austin, Texas
SN  - 9781931971324
KW  - rsa
KW  - fingerprinting
KW  - cryptographic library
KW  - side-channel analysis
UR  - https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/svenda
L2  - https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/svenda
N2  - Can bits of an RSA public key leak information about design and implementation choices such as the prime generation algorithm? We analysed over 60 million freshly generated key pairs from 22 open- and closedsource libraries and from 16 different smartcards, revealing significant leakage. The bias introduced by different choices is sufficiently large to classify a probable library or smartcard with high accuracy based only on the values of public keys. Such a classification can be used to decrease the anonymity set of users of anonymous mailers or operators of linked Tor hidden services, to quickly detect keys from the same vulnerable library or to verify a claim of use of secure hardware by a remote party. The classification of the key origins of more than 10 million RSA-based IPv4 TLS keys and 1.4 million PGP keys also provides an independent estimation of the libraries that are most commonly used to generate the keys found on the Internet. Our broad inspection provides a sanity check and deep insight regarding which of the recommendations for RSA key pair generation are followed in practice, including closed-source libraries and smartcards.
ER  -

ŠVENDA, Petr, Matúš NEMEC, Peter SEKAN, Rudolf KVAŠŇOVSKÝ, David FORMÁNEK, David KOMÁREK a Václav MATYÁŠ. The Million-Key Question – Investigating the Origins of RSA Public Keys. Online. In Thorsten Holz, Stefan Savage. \textit{Proceedings of 25th USENIX Security Symposium}. Austin, Texas: USENIX Association, 2016, s.~893-910. ISBN~978-1-931971-32-4.

Podrobný výpis o publikaci