Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

This is kind of hilarious.

I think the article might be a bit dense for those who aren't aware of RSA's algorithm though.



I agree. I've rolled OpenSSL certs for servers, but crypto isn't really a forte of mine. A generic rundown of implications would be nice.


You know that in RSA the modulus n is effectively your public key, right? And that n = p * q, where p and q are essential parts of your private key?

So if you can factor n into the corresponding primes, you have just cracked the person's private key.

Implications? You can decrypt all RSA encrypted messages for that private key. You can IMPERSONATE the person whose private key you have cracked. (Signature = data encrypted with private key that can be verified with the public key.)

All encrypted messages sent to the compromised keys must be treated as leaked. All signatures made by the compromised keys are suspect.

It's as bad as it gets for the individuals in question.


In essence, RSA is a crypto-algorithm that relies on the fact that "Factorization" is a very very hard mathematical problem for standard computers to solve.

For example, what are the factors of 143?? Answer: 13 x 11. Factoring is hardest when the number is made up of two prime numbers. Public Key cryptography is basically a giant puzzle based on the difficulty of factoring numbers.

Now, instead of small numbers that we humans use, what is typically done is two 2000+ bit prime numbers are chosen and then the resulting 4000+ bit number is used as the "encryption puzzle".

This 4096 bit number happened to be 231, which is 3 x 77. Huzzzahh! I guess 231 is a 4096-bit number... but generally speaking, you'd hope that the number at the center of your "encryption puzzle" would be a bit... larger. So that it'd be harder to factor it.


The ongoing conversation is pretty fun too - http://log.bitcoin-assets.com/?date=17-05-2015#1134741




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: