Check Your Fingerprints
Richard Klafter and Eric Swanson explores check your fingerprints at DEF CON 22, examining penetration-testing and practical defenses.
Summary
Architecture and Background
Check Your Fingerprints: Cloning the Strong Set Richard Klafter (Free) SENIOR SOFTWARE ENGINEER, OPTIMIZELY Eric Swanson (Lachesis) SOFTWARE DEVELOPER The web of trust has grown steadily over the last 20 years and yet the tooling that supports it has remained stagnant despite staggering hardware advancement. Choices that seemed reasonable 20 years ago (32bit key ids or even 64bit key ids) are obsolete. Using modern GPUs, we have found collisions for every 32bit key id in the strong set, with matching signatures and key-sizes (e.g.
Vulnerability Analysis
RSA 2048). Although this does not break the encryption the web of trust is built on, it further erodes the usability of the web of trust and increases the chance of human error. We will be releasing the tool we developed to find fingerprint collisions.
Exploitation and Demonstrations
Vanity GPG key anyone? Richard Klafter is a senior software engineer at Optimizely specializing in web security. In his free time you’ll find him writing new software or breaking existing software.
Remediation and Defensive Strategies
He coauthored scallion ( a vanity address generator for Tor’s hidden services. Eric Swanson is a freelance software developer with a passion for netsec. He coauthored scallion, a vanity address generator for Tor’s hidden services.
Related talks
Main Stage·47 min
Nir Valtman
Nir Valtman explores bug bounty programs evolution at DEF CON 22, examining penetration-testing and practical defenses.
Main Stage·35 min
Nemus
Nemus details an Introduction to Back Dooring Operating Systems for Fun and Trolling Nemus SECURITY RESEARCHER So you want to setup a back door.
Main Stage·42 min
Major Malfunction
Major Malfunction explores old skewl hacking: porn free! at DEF CON 22, examining penetration-testing and practical defenses.