Survey is good. Thesis is strange.
Recently, Arjen Lenstra and James Hughes et al released some excellent survey work in their “Ron Was Wrong, Whit Was Right” paper regarding the quality of keys exposed on the global Internet. Rather than just assume proper generation of public key material, this survey looked at 11.7 million public keys in as much depth as possible.
The conclusion they reached was that RSA, because it has two secrets (the two primes, p and q), is “significantly riskier” than systems using “single-secrets” like (EC)DSA or ElGamel.
Let me be clear. This is a mostly great paper, with lots of solid data on the state of key material on the Internet. We’re an industry that really operates without data, and with this work, we see (for example) that there’s not an obvious Debian-class time bomb floating around out there.
But there’s just no way we get from this survey work, to the thesis that surrounds it.
On the most basic level, risk in cryptography is utterly dominated, not by cipher selection, but by key management. The study found 12,720 public keys. It also found approximately 2.94 million expired certificates. And while the study didn’t discuss the number of certificates that had no reason to be trusted in the first place (being self signed), it did find 5.4M PGP keys.
It does not matter the strength of your public key if nobody knows to demand it. What the data from this survey says, unambiguously, is that most keys on the Internet today have no provenance that can be trusted, not even through whatever value the CA system affords. Key Management — as Whit Diffie himself has said — is The Hard Problem now for cryptography.
Whether you use RSA or DSA or ECDSA, that differential risk is utterly dwarfed by our problems with key management.
Is all this risk out of scope? Given that public key cryptography is itself a key management technology for symmetric algorithms like AES or 3DES, and that the paper is specifically arguing for one technology over another, it’s hard to argue that. But suppose we were to say key management is orthogonal to cryptographic analysis, like buffer overflows or other implementation flaws.
This is a paper based on survey work, in which the empirically validated existence of an implementation flaw (12,720 crackable public keys) is being used to justify a design bias (don’t use a multi-secret algorithm). The argument is that multi-secret algorithms cause crackable public keys.
You don’t just get to cite implementation flaws when they’re convenient.
More importantly, correlation is not causation. That we see a small number of bad keys at the same time we see RSA does not mean the latter caused the former. Alas, this isn’t even correlation. Out of 6,185,372 X.509 certificates seen by the survey, 6,185,230 of them used RSA. That’s all of 142 certificates that didn’t. We clearly do not have a situation where the choice of RSA vs. otherwise is random. Indeed, cipher selection is driven by network effects, historical patents, and government regulation, not the roll of the dice even mere correlation would require.
Finally, if we were to say that a cipher that created 12,720 broken instances had to be suspect, could we ever touch ECDSA again? Sony’s Playstation 3 ECDSA Fixed Nonce hit millions of systems around the world. Thus the fault with this whole “multi-secret” complaint — every cipher has moving parts that can break down. “Nothing is foolproof because fools are so ingenious”, as they say. Even if one accepted the single-sample link between multi-secret and RSA, the purportedly safe “single-secret” systems have also failed in the past, in quite larger numbers when you get down to it.
I don’t mean to be too hard on this paper, which again, has some excellent data and analysis inside. I’ve been strongly advocating for the collection of data in security, as I think we operate more on assumption and rumor than we’d like to admit. The flip side is that we must take care not to fit our data to those assumptions.
Apparently this paper escaped into the popular press.
I think the most important question to be asked is — if 0.2% of the global population of RSA moduli are insecure, what about those attached to unexpired certificates with legitimate issuers? Is that also 0.2%, or less?
(There’s no security differential if there was no security to begin with.)