tech_hw_krypto_token   1

Millions of high-security crypto keys crippled by newly discovered flaw
A crippling flaw in a widely used code library has fatally undermined the security of millions of encryption keys used in some of the highest-stakes settings, including national identity cards, software- and application-signing, and trusted platform modules protecting government and corporate computers. The weakness allows attackers to calculate the private portion of any vulnerable key using nothing more than the corresponding public portion. Hackers can then use the private key to impersonate key owners, decrypt sensitive data, sneak malicious code into digitally signed software, and bypass protections that prevent accessing or tampering with stolen PCs. The five-year-old flaw is also troubling because it's located in code that complies with two internationally recognized security certification standards that are binding on many governments, contractors, and companies around the world. The code library was developed by German chipmaker Infineon and has been generating weak keys since 2012 at the latest. The flaw is the one Estonia's government obliquely referred to last month when it warned that 750,000 digital IDs issued since 2014 were vulnerable to attack. Estonian officials said they were closing the ID card public key database to prevent abuse. Last week, Microsoft, Google, and Infineon all warned how the weakness can impair the protections built into TPM products that ironically enough are designed to give an additional measure of security to high-targeted individuals and organizations. The flaw is the subject of a research paper titled The Return of Coppersmith's Attack: Practical Factorization of Widely Used RSA Moduli, which will be presented on November 2 at the ACM Conference on Computer and Communications Security. The vulnerability was discovered by Slovak and Czech researchers from Masaryk University in the Czech Republic, Enigma Bridge in Cambridge, UK, and Ca' Foscari University in Italy.
ars technica, 16.10.2017
eid_dokument  itsicherheit_code_signing  itsicherheit_exploit_flaw  tech_hw_chip_krypto_tpm  krypto_bibliothek_rsa_infineon  unternehmen_infineon  krypto_entschlüsselung  krypto_algo_rsa  krypto_faktorisierung  krypto_key_recovery  de_bundesamt_bsi  itsicherheit_zertifizierung  itsicherheit_implementierung  krypto_openpgp  krypto_verschlüsselung_datenträger  krypto_verschlüsselung_kommunikation  krypto_verschlüsselung_transport  tech_hw_krypto_token  krypto_tls_cert  krypto_signierung  krypto_signierung_qes 
october 2017 by kraven

related tags

de_bundesamt_bsi  eid_dokument  itsicherheit_code_signing  itsicherheit_exploit_flaw  itsicherheit_implementierung  itsicherheit_zertifizierung  krypto_algo_rsa  krypto_bibliothek_rsa_infineon  krypto_entschlüsselung  krypto_faktorisierung  krypto_key_recovery  krypto_openpgp  krypto_signierung  krypto_signierung_qes  krypto_tls_cert  krypto_verschlüsselung_datenträger  krypto_verschlüsselung_kommunikation  krypto_verschlüsselung_transport  tech_hw_chip_krypto_tpm  unternehmen_infineon 

Copy this bookmark: