Researchers take another crack at SSL

SSL, or Secure Sockets Layer, is the “great enabler” of online commerce.

It’s the S in HTTPS, and it’s the padlock in the address bar of your browser.

It’s the underlying protocol which stops the cybercrooks enjoying a complete free-for-all when you spend money or read your email online.

Together, SSL and its big brotherTransport Layer Security (TLS, which is SSL with a beard and in grown-up clothes) provide a ubiquitous cryptographic mechanism by which two people on the internet, including people who have never met or done business with each other before, can exchange information with secrecy, authenticity and integrity.

Loosely speaking, that means they can verify that they really are talking to each other, not to an impostor; that no-one else is eavesdropping; and that no-one can tamper with the content of their conversation.

But SSL has recently been in the news for all the wrong reasons. For example, we’ve had the BEAST, Diginotar, Verisign, Stuxnet and, most recently, Trustwave.

In sequence, these SSL-related disaster stories involve: the prevalent server-side implementation of SSL/TLS in a cryptographically weak way; a corporate break-in allowing an Iranian hacker to mint himself fake online SSL IDs; an admission by a certificate authority that it had been hacked in 2010 but forgot to tell anyone; stolen SSL certificates used by a virus writer; and a certificate authority that got caught out creating an eavesdropping SSL certificate for a customer.

It gets worse. Not one but two research papers have just surfaced, digging into the mechanics of actually building the bits-and-bytes of SSL certificates. The results aren’t catastrophic, but they are, to say the least, interesting.

Most SSL certificates rely on a public key encryption algorithm called RSA for their authentication component. The idea is that I create a pair of keys: one public; the other private. So if I sign something with my private key, you can use my public key to verify that only I could have signed it. And if you encrypt something with my public key, you can be sure than only I can unlock it.

Provided, of course, that my private key really is private.

Assuming no-one steals my key, or pays a certificate authority to issue a fake key in my name, just how unique [*] is is my private key? Is there a chance that someone else, without any malice aforethought, might unexpectedly end up with a key pair that is identical or at least dangerously similar to mine?

“Yes,” according to this latest research.

The problem comes in key generation. Greatly oversimplified, RSA requires you to generate a unique pair of prime numbers, p and q, and to publish, amongst other things, their product, n. You can’t be mathematically certain that your p and q are unique, but if they are generated genuinely randomly, the chance that someone else chose them already ought to be vanishingly small.

If you could split n back into p and q, you would have cracked the key. So the security of the system depends on the difficulty of taking that public value n and converting it back into its prime factors p and q.

Prime numbers are only divisible by themselves. So the product of two prime numbers is divisible only by itself and those two primes. Factoring small primes is easy. 15, for example is 5 x 3. You can do this in your head. But factoring ever-larger prime products is ever harder. Try doing the 10-digit product 9326222179 [**] in your head, and then bear in mind that the smallest prime products recommended for current use in RSA keys are over 300 digits long (1024 bits).

So, if someone else has a key with the same n as yours, you know their p and q, because each n factors in only one way. Alternatively, if they choose one of p or q non-randomly, you have a better-than-average chance of guessing it. Since q = n/p and p = n/q, guessing one prime factor gives you the other one on a plate.

And the recent research found a small but worrying number of public keys which shared the same value of n, or which used prime factors from an obviously non-random source.

I’m not going to repeat the papers’ findings here – the authors deserve that you read the actual results by clicking through to their own articles, here and here – but both sets of researchers found duplicated ns (prime products), and ns which could be factored easily.

At least some of these problems are explained by poor (or just plain wrong) random number generation, leading to one or both of p and q being guessable, thus breaking the privacy of the resulting private key.

As the famous mathematician and computer scientist John von Neumann is supposed to have said:

Any one who considers arithmetical methods of producing random digits is, of course, in a state of sin. For, as has been pointed out several times, there is no such thing as a random number. There are only methods to produce random numbers, and a strict arithmetic procedure ... is not such a method.

If you’re a coder, don’t cut corners on randomness. And never, ever try to roll your own pseudo-random number generator, unless you’re a world-class cryptographer.

[*] Prescriptive linguists would say that ‘unique’ is binary. There aren’t degrees of uniqueness. They are right. I am attempting a literary manoeuvre here. Please run with it.

[**] 9326222179 = 104729 x 89051