Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add close-primes detection via Fermat's factorization #5853

Merged
merged 6 commits into from Dec 14, 2021
Merged

Conversation

aarongable
Copy link
Contributor

@aarongable aarongable commented Dec 14, 2021

Add a new check to GoodKey which attempts to factor the public modulus
of the presented key using Fermat's factorization method. This method
will succeed if and only if the prime factors are very close to each
other -- i.e. almost certainly were not selected independently from a
random uniform distribution, but were instead calculated via some other
less secure method.

To support this new feature, add a new config flag to the RA, CA, and
WFE, which all use the GoodKey checks. As part of adding this new config
value, refactor the GoodKey config items into their own config struct
which can be re-used across all services.

If the new FermatRounds config value has not been set, it will default
to zero, causing no factorization to be attempted.

Fixes #5850
Part of #5851

@aarongable aarongable requested a review from a team as a code owner Dec 14, 2021
Copy link
Contributor

@jsha jsha left a comment

Basically looks good to me, just comment fixes and a modest proposal about the return interface (take it or leave it).

goodkey/good_key.go Outdated Show resolved Hide resolved
goodkey/good_key.go Outdated Show resolved Hide resolved
goodkey/good_key.go Outdated Show resolved Hide resolved
goodkey/good_key.go Outdated Show resolved Hide resolved
goodkey/good_key.go Outdated Show resolved Hide resolved
goodkey/good_key_test.go Outdated Show resolved Hide resolved
aarongable and others added 2 commits Dec 14, 2021
Co-authored-by: Jacob Hoffman-Andrews <github@hoffman-andrews.com>
@aarongable aarongable requested review from jsha and a team Dec 14, 2021
jsha
jsha previously approved these changes Dec 14, 2021
Copy link
Contributor

@jsha jsha left a comment

Left a nit but it's definitely nonblocking.

goodkey/good_key.go Outdated Show resolved Hide resolved
jsha
jsha previously approved these changes Dec 14, 2021
@beautifulentropy beautifulentropy self-requested a review Dec 14, 2021
beautifulentropy
beautifulentropy previously approved these changes Dec 14, 2021
@aarongable aarongable dismissed stale reviews from beautifulentropy and jsha via 248fa97 Dec 14, 2021
jsha
jsha approved these changes Dec 14, 2021
@beautifulentropy
Copy link
Member

beautifulentropy commented Dec 14, 2021

Looks fantastic!

@aarongable aarongable merged commit 89000bd into main Dec 14, 2021
15 checks passed
@aarongable aarongable deleted the ff-check branch Dec 14, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants