1 June 1998
Date: Mon, 01 Jun 1998 10:51:58 -0400 To: jy@jya.com From: Ed Stone <estone@synernet.com> Subject: Thawte Digital ID Process - More weak RSA 512-bit keys for S/MIME-apps Thawte is a Certificate Authority headquartered in South Africa. Its Digital ID database center is located in the Washington, DC area. Using the MSIE 4.0x domestic US-high-security version from a Win95 machine, and getting a trial certificate from them, one encounters a web page similar to the one at VeriSign, but for those seeking MSIE S/MIME email certs, and connecting using the high-security MSIE browser, the key length that you may obtain is dispayed in a drop down box, with "1024 bits" selected. Ah, a strong key. Select it, generate your key, and get your certificate. Now you have a strong, secure, long RSA 1024-bit asymmetric key protecting your email, right? Wrong. You selected 1024-bit key length, but without notice, the Thawte enrollment process generates an RSA 512-bit key on your local machine. Weak crypto. It is clear that the current web-based enrollment process of Thawte and VeriSign can lead some users of the MSIE high-security browser to unknowingly generate weak keys. For a description of the VeriSign process, see http://www.jya.com/vs-msie.htm RSA 512-bit crypto is not recommended (by RSADSI) for use at this time even for low to moderate security applications. See RSADSI's security estimate for RSA 512-bit keys at http://www.rsa.com/rsalabs/pubs/techreports/security_estimates.pdf. Non-crypto-techie users of these keys may believe they have serious security, when they do not. Those who seek to have S/MIME taken seriously should be concerned about this failing. S/MIME advocates who are also proponents of strong crypto will undoubtedly find this lapse of security unacceptable, and make their concerns known. -------------------------- Ed Stone estone@synernet.com --------------------------