Source: ComputerWorld.com.
An online encryption method widely used to protect banking, email, e-commerce and other sensitive Internet transactions is not as secure as assumed, according to a report issued by a team of U.S and European cryptanalysts.
The researchers reviewed millions of public keys used by websites to encrypt online transactions, and found a small but significant number to be vulnerable to compromise.
In most cases, the problem had to do with the manner in which the keys were generated, according to the researchers. The numbers associated with the keys were not always as random as needed, the research showed.
Therefore, the team concluded, attackers could use public keys to guess the corresponding private keys that are used to decrypt data — a scenario that was previously believed to be impossible.
“This is an extremely serious cryptographic vulnerability caused by the use of insufficiently good random numbers when generating private keys” for HTTPS, SSL and TSL servers, said Peter Eckersley, senior technologist at the Electronic Frontier Foundation. The EFF contributed data for the research.
“We are presently working around the clock to inform the parties whose keys are vulnerable and the [Certificate Authorities] that issued certificates for them, so that new keys can be generated and the vulnerable certificates can be revoked,” he said.
The research was originally scheduled to be released later this year, but became public knowledge in a New York Times story on Tuesday.
Categories: Internet, Research, Science, Science and Technology, Technology
It reminds me – well, it is probably 15 years ago – when a Malaysian bank issued a challenge: Anyone who could break into their ‘safe’ new internet banking would get a reward of 20’000 Malaysian Ringgit. It took only 20 minutes and the first hacker was in (and the bank had to go ‘back to work’ and postpone the internet banking access).