3

On the Practical Exploitability of Dual EC in TLS Implementations by Stephen Checkoway et al. (Usenix 2014) is some research that has been done on how much this NSA backdoor has affected the internet. In short: It's hard to say. What saved a lot of systems from being compriomised is the fact that Dual_EC_DRBG was poorly executed and recommended against early....


2

This would be done by a last round attack. The attacker would collect a crib of known pairs of inputs that differ by the plaintext difference (01010001101011 in your example). They would then run through $2^{16}$ guesses for the last round key, for each guess they would be able calculate the difference between each pair in round $r-1$ (by running just one ...


1

If you start at $k=1$, we expect you to end the loop at some smallish $k_P$ (and smallish $k_Q$). Note that this makes $P-Q=(k_P-k_Q)\cdot A+(P'-Q')$ so that it is not uncommon to have $k_P=k_Q$ so that $P\approx Q$ and factorization of $N$ is facilitated. If you collect many, many backdoored $N$, you may succeed sometimes. (I know that still $P'-Q'\gg1$, ...


1

does starting the iteration from $k=1$ instead of $k=P'$ make a difference? If you start iteration from $k=P'$ then you get; $$P = A\cdot (P'+i) + P'$$ where $ i = 0,1,2,\ldots$. Take modulo $A$ $$P = A\cdot (P'+i) + P' \pmod A$$ $$P = P' \pmod A$$ Therefore it will still work to reveal the $P'$ in the way $N'$ is generated, what is the best way to ...


Only top voted, non community-wiki answers of a minimum length are eligible