After the Snowden revelations, is there any mass change being carried out to HTTPS protocol?

As far as I understood, any HTTPS communication is still visible to NSA as they can compromise the RSA protocol. Is there any existing alternative of RSA that the government and multinational organizations (where confidentiality is top priority) are using right now?

I am trying to view the contemporary picture post to Snowden revelations.

  • 1
    "as they can compromise the RSA" [citation needed] They might be able to break 1024 bit RSA keys, but there has been no sign that they can also break larger keys (there is an ongoing migration to 2048 bit RSA keys which started years before the leaks). – CodesInChaos Mar 26 '14 at 8:35
  • 1
    Where have you picked up all of this? Yes, the NSA has most probably advantage over the public in regards to factoring large primes, but they certainly can't factor 1024 bit primes on a on-the-fly basis. Even if they could, changing the key size to 2048 or even 4096 bits would make it absolutely infeasible. As to alternatives to RSA as public key crypto system: There are a lot, e.g. DSA, DH, ECC, ElGamal. – Karol Babioch Mar 26 '14 at 10:25
up vote 9 down vote accepted

There is nothing in the "Snowden revelations" which even hints at any special NSA ability at breaking RSA. Even taking all that Snowden says as gospel, NSA is still at the same point as everybody else, meaning that breaking 1024-bit RSA is "theoretically feasible" but subject to the building of a very special machine whose design has been roughly sketched, which would cost a substantial number of millions of dollars, and, crucially, which would need quite some time (months...) to break every single key. For a 2048-bit RSA key, just forget it.

According to all the Snowden-powered information, when NSA "breaks SSL", they do it sensibly, i.e. not by punching through the cryptography upfront. Instead, they bribe the hosting sites to put spying hooks directly on the clear data, SSL notwithstanding. This is way cheaper, works reliably, and does not require invoking sci-fi level supposed cryptanalytic advances or alien technology.

Building and using RSA-breaking technology for mass-SSL spying would strike me as an extremely inefficient use of budget by the NSA.


Nevertheless, there are alternatives to RSA, and some have been part of SSL since the days of SSL 3.0, two decades ago. With the standard core protocol (called TLS 1.2 these days), you have the DH_DSS and DHE_DSS cipher suites, which involve Diffie-Hellman for key exchange, and DSA for signatures (with DH_DSS, the server's certificate contains a DH public key and the issuing CA contains a DSA public key; with DHE_DSS the server's certificate contains a DSA public key and the DH key pair is produced on-the-fly). Elliptic-curve variants have also been defined. Modern browsers and Web servers support DHE_DSS and elliptic curve variants thereof.

Historically, these alternatives were developed not for security, to fix some perceived or alleged weakness of RSA; they were put into SSL because at that time, RSA was still patented in the USA, and none other than the US federal government needed a patent-free but secure protocol for its own usages.

Now that the RSA patent has expired (more than 12 years ago), everybody does RSA. Yet alternatives are ready, and will be used if RSA appears broken. Which it currently does not, even against NSA.

  • Thanks for you insightful answer. My question stemmed from a misconception that NSA can decrypt any RSA encription through a backdoor provided by RSA. I have found a link afterwards that strikes the myth- [link] businessinsider.in/… My doubts are clear now. – Arka Mar 26 '14 at 11:57
  • @Thomas Pornin: NSA was paying RSA to pick easily guessable private keys (and continues to push for legislation guaranteeing backdoors in commercial SW): beforeitsnews.com/alternative/2013/12/… – micahhoover Oct 24 '14 at 19:41

The following article explains some ways that NSA could undermine the security of SSL:

http://blog.cryptographyengineering.com/2013/12/how-does-nsa-break-ssl.html

To summarize, here are some of the methods the NSA may be using to break internet encryption:

  • Compromising RSA keys, either by remote software exploit or subpoenas and gag orders.

  • Suborning hardware encryption chips

  • Side channel attacks - such as a BREACH attack, see "SSL, GONE IN 30 SECONDS" - http://breachattack.com

  • Weak random number generators -- such as the very suspicious Dual_EC RNG which was the default for RSA's BSAFE library.

Also, the NSA's codename for their decryption program, called "BULLRUN", may be read about here:

http://en.wikipedia.org/wiki/Bullrun_(decryption_program)

I think there is no alternative for RSA as its the most used algo for all public key crypto mechanisms, I read somewhere that NSA pay RSA in order to keep the algo weakest, actually using an RSA key with less than 1024 bits is vulnerable to brute force attacks, security experts recommend 2048 bits as key length, but NSA still have the possibility to spy because somehow they can get the key used for encyption. Personally I recommend using "TOR project", it's an awesome project based on onion routing BUT the inconvenience is latency because of computing time and routing.

  • 1
    There are quite a few alternatives, but RSA itself is just fine for now as explained above. – Karol Babioch Mar 26 '14 at 12:03
  • @KarolBabioch fine but it's not quit secure – ismael May 5 '14 at 10:11
  • What are you referring to? It obviosuly is not perfectly secure. But anything short of a One-Time-Pad isn't. It is computationally secure, however, so unless there are bugs in the implementation, you are fine in any practical way. – Karol Babioch May 5 '14 at 14:14
  • 1
    @ismael You are confusing RSA the cryptosystem with RSA the company. The cryptosystem was invented well before the company was bribed by the NSA. In particular, the NSA bribed the company to make Dual_EC_DRBG (a backdoored ECC-based PRNG) the default for BSAFE. That has absolutely no impact on RSA the cryptosystem, which is still secure. – forest Aug 18 at 13:56
  • TOR is in no way a replacement for RSA or any encryption algorithm or as a replacement to HTTPS. So, 1) there are alternatives to RSA, 2) RSA the vendor is not RSA the algorithm, 3) NSA cannot get the key from RSA, 4) TOR is unlreated to the question. – schroeder Aug 22 at 9:32

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.