Re:Socat: “the hard coded 1024 bit DH p parameter was not pr...
by wtbob on Monday February 01, 2016 @08:09PM
(#11017042)
It's not about bruteforcing.
If I want a 128-bit security level, I'm willing for a random guess of my key to have a 2^-128 chance of being correct. I'm likewise willing for a prime I generate to have a 2^-128/uses chance of not being prime (where uses is equal to the number of times I'll actually be using it).
I can't be 100% certain that a large number is actually prime. But I can be certain enough. Having a 2^-80 chance of being wrong isn't good enough when I want a 2^-128 security level.
Re:Socat: “the hard coded 1024 bit DH p parameter was not pr...
by mrb on Monday February 01, 2016 @09:04PM
(#11017242)
Yes, security margins are all about what can and cannot be brute forced!
You can't compare these 2 scenarios directly, because in practice:
- attackers can take as many guesses as they want against a piece of data protected by a 128-bit key, but
- attackers get only 1 chance that a particular piece of data protected by a supposed prime is not a prime.
An attacker who can bruteforce, say, 2^80 128-bit keys (approximate limit of the computational power of the largest adversaries) has 1 chance out of 2^48 to break the security.
But an attacker has only 1 chance out of 2^80 that this parameter is a non-prime.
2^80 is much larger than 2^48, therefore it is not a problem.