Check Your Fingerprints: Cloning the Strong Set

Presented at DEF CON 22 (2014), Aug. 9, 2014, 3:30 p.m. (30 minutes)

The web of trust has grown steadily over the last 20 years and yet the tooling that supports it has remained stagnant despite staggering hardware advancement. Choices that seemed reasonable 20 years ago (32bit key ids or even 64bit key ids) are obsolete. Using modern GPUs, we have found collisions for every 32bit key id in the strong set, with matching signatures and key-sizes (e.g. RSA 2048). Although this does not break the encryption the web of trust is built on, it further erodes the usability of the web of trust and increases the chance of human error. We will be releasing the tool we developed to find fingerprint collisions. Vanity GPG key anyone?

Presenters:

• Eric Swanson (Lachesis) - Software Developer
  Eric Swanson is a freelance software developer with a passion for netsec. He coauthored scallion, a vanity address generator for Tor’s hidden services.
• Richard Klafter (Free) - Senior Software Engineer, Optimizely
  Richard Klafter is a senior software engineer at Optimizely specializing in web security. In his free time you’ll find him writing new software or breaking existing software. He coauthored scallion (https://github.com/lachesis/scallion), a vanity address generator for Tor’s hidden services.

Links:

• https://defcon.org/html/defcon-22/dc-22-speakers.html#Klafter
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 slides/DEF CON 22 - Hacking Conference Presentation Richard Klafter (Free) & Eric Swanson (Lachesis) - Check Your Fingerprints - Cloning the Strong Set - Slides.mp4
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 slides/DEF CON 22 - Hacking Conference Presentation Richard Klafter (Free) & Eric Swanson (Lachesis) - Check Your Fingerprints - Cloning the Strong Set - Video.mp4
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 slides/DEF CON 22 - Hacking Conference Presentation Richard Klafter (Free) & Eric Swanson (Lachesis) - Check Your Fingerprints - Cloning the Strong Set - Slides.srt (subtitles)
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 video and slides/DEF CON 22 - Richard Klafter (Free) & Eric Swanson (Lachesis) - Check Your Fingerprints - Cloning the Strong Set - Video and Slides.mp4 (Video and Slides)
• https://www.youtube.com/watch?v=3LZhFFm1tK0

Similar Presentations:

• DEF CON 28 (2020) Virtual / Exploiting Key Space Vulnerabilities in the Physical World
• HOPE Number Six (2006) / Breaking Down the Web of Trust
• The Fifth HOPE (2004) / Encryption Key Signing