Modification of the prime generation method of the OpenSSL library
Tihanyi, Norbert
Random numbers are very important in many fields of computer science, especially in cryptography. One of the most important usages of pseudorandom number generators (PRNG) are is key generation methods for cryptographic purposes. In this presentation a modification of the prime generation method of the OpenSSL library will be presented. The modified version of the library passes every well-known statistical tests (e.g NIST test, DIEHARD test), however while an adversary is still able to reconstruct the prime numbers (P,Q) from the public key. The method can be used for malicious purposes as a sophisticated backdoor. The presented research is based on the theory of kleptography and a recently published research paper.
 Welcome ladies and gentlemen. My name is Norbert Ianni and I was working for the Hungarian SA more than seven years and I was responsible to make penetration testing and trip analysis and we do some some researches relating to prime number theory and right now I'm a senior secretary advisor at a Hungarian company. As you can see my t-shirt this is a green t-shirt. As you know we didn't have such kind of cool t-shirt in the Hungarian SA so maybe this was the first reason why I just left the company. In this presentation I'm just would like to show you how to hide some backdoors and how to make some malicious code or random number generations methods and how to identify these codes and after that how to implement in practice these backdoors and applications on prime number generation methods and in backdoors of random number generations. The general background of the research can be shown in these slides and the main concept of this presentation is based on the following researches that you can see in the slides. Sight-tune-up, cryptography, pseudo-random generation and this presentation also presented in the Central European Conference on Cryptology in Budapest. We went into the Mathematica background and right now we implemented the code and right now we would like to show you how to implement in the real practice and how to make some fake certificate how to implement some sophisticated backdoors or random number generators and this research also based on the fourth injection based backdoors in pseudo-random number generators. This research started within the umbrella of the Hungarian NSA and right now we try to try to implement all of the codes and this is the main reason we would like to show you how you can do it and after the presentation you can also get the source code of these algorithms and implementations. As you know OpenSSL there are numerous open source applications that are using OpenSSL library and you know for example OpenSSH age or curl, stunnel and all of these applications is very important to emphasize that these applications are based on the secret of OpenSSL so it means if you can make some backdoors in this library or you can you can implement new techniques to this OpenSSL library after that there is a chance to hide some backdoors. Of course it's not so easy because as you know there are you know there are some checksums on the library and there are many many differences how to prevent this kind of malicious activity. So the main question is as I'm trying to try to show you in my presentation that is it possible to hide the backdoor on a well-known algorithm. For example everybody knows that RSA or AES is well known for security experts so it means that if you would like to make some some white box with it for example in AES codes if you know how does it work if you know what the algorithm is doing and you have some test vectors it's very easy to identify the backdoors for example in an encryption algorithm. It means as you can see in the slides for example you have encryption key you have an initiation vector you have test vector and you have a cipher text and if you know how AES algorithm is working on you can make some tests. There is an input there is an output it's working or not if the output is different than the sample or the text then it means that maybe there is some backdoors on the AES algorithm or there is some programming mistakes on the algorithm. So it means such kind of test vectors are proof of concepts that modification have been made for example on the algorithm and it's very difficult to hide a well-known backdoor in AES RSA or well known encryption algorithm. So this was the main idea that modification an encryption algorithm is lead to a non-sophisticated backdoor. So what about random number generators? As you know there are no test vectors. It means because the behavior of the random number generators is to produce true random numbers. Of course if you are using only softwares not hardware if so no random number generators but of course you can try to make very variable random numbers. However you have to use some statistical tests like the National Institute standard of technology tests or the die-hard tests in order to modify the output or in order to test the output. If you would like to modify there is no test vectors it means as I mentioned in the previous slides. If you are using AES there are test vectors and it's working or not. In the random number generator methods because there are no test vectors you cannot identify the malicious code on the random number generators. Just figure out that's imaging that there is an embedded system there are some hardware random number generation on the embedded system and you don't know the source code. You know only the output of the random number generator and if this random number generator passes all statistical tests like the NIST test or die-hard test it should be good random number generator and you cannot do nothing with this. So as you can see the main idea how to modify pseudo random number generator for example in the open SSL library in such a way that the modified output still passes all statistical tests. I mean if I'm modifying the random number generator it should pass all statistical tests. If not of course it's cryptographically not secure. So this was the main idea and we tried to make some mathematical background relating to this topic and we try to try to implement in the practice. So the first one is just presented in some conferences and there is a term that how to use this kind of mathematics relating to number towering to hide some backdoors in pseudo random number generator and after that you cannot identify the the backdoors in the random number generator. So as you can see in the slide that let me define a pseudo random number generator and let BI denote an IBitLens binary sequence and let us define the following function as you can see. Fee BI and I wouldn't like to go into details but it's very important to relate into this topic that's there is a term that's there exists a polynomial time P algorithm with two of m periods and fee P BI EGAS 0 it means and that's observing only two m minus one and consecutive bits from the output of the pseudo random number generator it is possible to predict the next bit with 100% of success. It's very important the next bit and 100% of success. So it's it's very easy to create such kind of algorithm. In the slides there is a proof of concept concept algorithms relating to the AES it's called C self encryption AES and this is a POC proof of concept algorithm and as you can see in the slides here is a seed he's an AS encryption it's a combination of the counter mode and the CBC mode as you can see in the slides so the output is shifted back and there is a new input for the next block. As you can see that's I will call capital C because there is also a CI with this one so capital C is this one and the C is only this one so capital CI plus one you got to the encryption key of CI and it's as you can see or not see here is the next one block and there is no loop in the algorithm so it means if I'm using this kind of cycle and using this kind of counter mode it can be proved that the size and length of the self encryption AS is minus two of 128 bits and there is no loop in the counter mode in such a way as you know AES is designed in such a way that try to pass all of known well known statistical tests like the National Institute standard of technology test the NIST test or the diehard test so it means if you are encrypting pseudo random number generator output in such a way the output is always predictable and the output cannot be distinguished from true random numbers only by statistical tests so if you know the source code if you are know how this algorithm is working you can predict the next bit with 100% of success however with only statistical test I have to emphasize that only with statistical test you cannot distinguish from two random numbers and it's very interesting relating to the proof of this proof of concept algorithm that there is a very important corollary as you can see in these slides so if you would like to observing how many bits you have to observe in order to reconstruct the internal seed of the random number generator you have to observe only 383 bits so it's not too much to reconstruct the next bit so it means as you can see in this proof that consecutive capital CI and CI plus 1 is 256 bits of course always can be found in 383 bits if you just would like to to to image in this scannario there is a slide there is a picture and you can check that's 258 bits always can be found only 383 bits relating to this one it's only just a proof of concept code so if someone tried to implement these codes in open SSL library it's not as sophisticated because if you have a white box on it and there is a security expert and the security expert just try to check these combination of counter mond and cbc mode of the AS algorithm he will definitely identify the malicious activity in this encryption method however it's very interesting that we just make some malware to modify the open SSL library and try to modify the internal state of the prime number generation as you know if I'm trying to modify the prime number generation for example in open SSL library after that there are some statistical tests that have to pass the output so it means if I'm doing some bad prime numbers and so on and so on after that they really won't qualify and really don't want to pass his or statistical testing open SSL library so you have to be very careful when you are modifying prime numbers generation method of the open SSL library in this algorithm you can see that it's a very interesting algorithm that's you are just searching prime numbers less than the binary lengths of the number is 1024 so it means you just multiply together prime numbers less than 100,000 and as maybe some of you heard about that's in 1947 John Polard proved that is it possible to factorize very large numbers in polynomial time if for example if it's prime factors prime P-1 or P-1 has only small prime factors small prime factors means for example less than 100,000 as we see in the previous section in this slide so it means if somebody would like to make such kind of sophisticated backdoor rating to prime number generation they can use for example these techniques to to generate some prime numbers and after that we can check that how many how many thank you okay so after that you just generated some prime numbers you can test with NIST test and other sophisticated statistical test and POS is all well-known statistical test it means any method that's implemented in open-essertial library will not identify that any malicious background activity is going on in the code in this slide you can see that just one you can see a public key just we generated a public key with all modified open-essertial library and after that we just published the public key to everybody and as you know it's a 2048 it's public key and so it's almost infeasible to to factorize however if you are using such kind of backdoors or you are if you are using such kind of malicious random number generators is it possible to reconstruct its prime numbers there is a mistyping this slide can you see it this is a public key of the previous public key this is the decimal number of the n modulus from this public key of course it is a base 64 encoded version of the public key and this is the n modulus decimal number this is a 2048 bits number and we just generated in such a way as I mentioned to you with John Pollard techniques because we would like to reconstruct the private key from the public key so I would like to emphasize that after that is it possible to reconstruct the private key from the public key and of course if you are using only statistical test you cannot find any malicious activity only in the numbers because there are no such kind of activities going on if you know you can also check on the internet that Polar's P-1 algorithm pseudo code as you can see here the first step is threat as smooth as bound be I really wouldn't like to get into details how to select these bound but after that there is a very important part of the algorithm this one that the algorithm is running till the time limit is not reached so it means have you ever tried to factorize a very large number for example if it's large number it's more than 2000 bits it means you try to factorize it and your computer is not working there is no result nor is nor is that there is no result so it means you cannot factorize it however as I mentioned to you and this number is it possible to factorize this computer is factorized approximately eight minutes and is it possible to reconstruct p and q prime numbers and if I'm choosing the smoothness be number larger than 100,000 for example 1 million 10 million 100 million then it means the factorization time is not eight minutes or not five minutes one hour one day one week so it means if you are trying to to factorize a large number and there is no result you don't know why is there is no result in the output because this is a very secure huge number or there is a very large smooth number and generated in such a way these numbers I really don't want you to to make explanation of this algorithm you can find also in the internet we just used the combination of this algorithm and the combination of the previous mentioned algorithm self encryption AES to produce sophisticated and very good quality random numbers in OpenSSL library. Of course relating to the huge decimal number between one minutes corey seven laptop would found all of the prime factors of the huge numbers so you can find p and q less than within one minute so it means that is it possible to reconstruct from the public key the private key and it's of course everybody knows that is a malicious activity can be used in embedded system in web pages or when you are using some age or something like that. Of course just some words relating to the new randomness test that's when you are modifying the OpenSSL output that is very well known statistical test that your generated numbers have to pass so it means I'm just generating some bad numbers and they are not passes all statistical tests from the National Institute standard of technology test it means that these numbers are failed so you cannot use for cryptographic purposes it's very well known. However we tested all of these all of the 15 and 16 and 17 tests it's there are some some extended tests in the niche test so all of the 15 tests pass the output of the random number generation and after that we tried to modify some other numbers. We tried different approaches also maybe you have ever about sharkism of the theoretical tests we also applies the well distribution this one and we also applied correlation measure this one and after that we didn't identify any differences between two random numbers and between the generated random numbers so we didn't find any statistical test that can distinguish these bad numbers from good numbers. So after the statistical test we try to implement risk an aerial and we try to we try to make some some implementation of the code so we just you can see the vkssl.com and we just requested this domain and we generated CSR and sent to Commodore that we would like to HTTPS certification you know we would like to use a second communication and we just request a certificate and certificate issued by Commodore secuCA and this is a 2048 bits encryption rating to the RSA as you know and it's very interesting that if you're a CA it's not possible to identify any malicious activity in such kind of numbers because you don't have enough researches to make factorization to find bad behaviors in such kind of numbers so it means after that they approved and issued the certificates we just deployed to vkssl.com you can check on your mobile phone also vkssl.com is active and it's working of course you can check some SSL uptests you maybe you know it that's we try to configure the server very securely it means a plus one you know it's everything is enabled on the server so it's very secure it seems to very secure as you can see TLS fiber core so it's enabled and HTTPS forward secrecy is also enabled on the server so rating to the security certificates everything is turned on and the server is seems very secure rating to the certification and also certified by the Commodore. As you can see in these slides just using some very basic comments in Linux for example OpenSSL, ash client connects you can just download the certificate from the server it's very easy you can download you can try it and after that you can write out the modulus and you can write out from the certificates which is the public key modulus this is the huge number and the next step is try to factorize this number and we've written the source code in Parigipi it's a computer algorithm system it's very easy to use every function you have to find in relating to number theory you can very easy write some programs relating to this topic and you can find some very cute stuff in this program as you can see in the presentation and this this slide here is the modulus this is the large 2048 this number and you have to factorize it of course if you try to factorize normal number it take more than a million years in a single computer so it you cannot do this however this method is generated by our sophisticated modified OpenSSL library and after that this is the polar p-1 algorithm invited by John Pollard in 1974 just we wrote this program in Parigipi you can see it's very short one and we just try to try to factorize the huge number this one and as you can see it takes one minutes and 31 seconds within two minutes we were able to to factorize the huge number and the certificate and it means that is it possible to reconstruct from public key the private key and if you see that just for example like in vk.shr.com that everything is secure the certificate is certified by a very well-known CA and everything is configured well maybe there is some some problem with the certificate also because you can you can you can make some such kind of bad prime numbers that can be used in such kind of certificates. Summarizing the research it's very important to emphasize that kleptography this is a so-called so theory of cryptography when you try to hide information with cryptographic methods and try to steal information for example from companies with cryptographic methods it's very well known nowadays and we just modified OpenSSL library however you can use this kind of methods in embedded system and it's very important to know that when you are using some kleptographic methods and there is a white box on it a security expert won't identify any malicious activity for example in a source code and of course if you know that such kind of prime number generation exist and you will see the source code you will know that there is some problem with the prime numbers however if you know only the outputs for example the certificate like in vkssl.com you don't have any clue how to factorize it you don't have any clue how the prime numbers p and q generated so it means you can make some backdoors you can implement some backdoors in such kind of applications like SSH or certificates. This is a working member on Linux it means that you can find the binaries of the OpenSSL and is it possible to to modify the binaries and after that the prime number generation is malicious and of course as I mentioned to you it's very important to emphasize that it is not possible to distinguish my statistical tests so many many random number hardware random number generation or software random number generation generator try to try to approve in such a way that they try to analyze the output in this way if you're trying to analyze the output it's not possible to distinguish from other true random number generators. Okay thank you for your attention if you have any question relating to random number generation or relating to the source code I'm ready to answer it or we can also send to you in email to you to try it or you can also try it to to softwareansweekhssh.com or delizen.shh this is also weak in weakhssh.com thank you very much. Does anybody have any questions that like to ask we have a few ministers there. Come on. Come on. You must be very clear. Nothing. Ah that's one gentleman. Sure question. How do you study the topic of manipulate the ECC generation through this thing? Yeah you mean some problems relating to advanced know them and some some elliptic curve generation methods. Yes as you know reacting to cryptography many huge companies like NSA or or or Hulet Park arts or something like that's very huge companies are using such kind of backdoors and it's very interesting because when you are when you are identifying a backdoors relating to kleptography you don't know it's it's really a backdoor or is just some mistake in the mathematics programming. When I checked relating to elliptic curve they are using that not the same techniques but some kleptographic techniques how to hide some secret parameters relating to the elliptic curve and after that they try to try to how can I say you know when you are generating prime numbers we have some statistical prime numbers generator it means there is a chance that is not a prime number but it's very highly likely that is a prime number like million ruby interest or something like that and when they are just generating some elliptic curve they just told everybody that it's 100% secure and it's 100% there is a little chance that is there is not on the curve and something like that and after that some years ago it's they identified that it's there is some problem with with the curves and this is the same techniques relating to these other number theoretic groups like elliptic curves so they are using maybe a more sophisticated backdoors and it's you don't have such kind of research is you don't have many super computers to analyze that is really a prime number this is really on the curve or something like that and of course they have that research and they can make such kind of sophisticated backdoors as I mentioned to you my computer takes eight minutes to reconstruct from the public key the private key it means I can choose a larger number and it takes eight days so when you are trying to factorize after one day after two days you just finish it okay it's a very secure number however if you try to run more than eight days you will find the factors so this is the same if you don't have enough research is to find some curves on the elliptic curves and find some secret parameters you think that everything is secure on this random number generation however after that's everybody try to find these secret parameters and everybody try to calculate everything after that they found and realized that there is some problem with the number generator okay thanks very much thank you very much
 Welcome ladies and gentlemen. My name is Norbert Ianni and I was working for the  Hungarian SA more than seven years and I was responsible to make penetration  testing and trip analysis and we do some some researches relating to prime  number theory and right now I'm a senior secretary advisor at a Hungarian company.  As you can see my t-shirt this is a green t-shirt. As you know we didn't have  such kind of cool t-shirt in the Hungarian SA so maybe this was the first  reason why I just left the company. In this presentation I'm just would like to  show you how to hide some backdoors and how to make some malicious code or  random number generations methods and how to identify these codes and after  that how to implement in practice these backdoors and applications on prime  number generation methods and in backdoors of random number generations.  The general background of the research can be shown in these slides and the main  concept of this presentation is based on the following researches that you can  see in the slides. Sight-tune-up, cryptography,  pseudo-random generation and this presentation also presented in the  Central European Conference on Cryptology in Budapest. We went into the  Mathematica background and right now we implemented the code and right now we  would like to show you how to implement in the real practice and how to make some  fake certificate how to implement some sophisticated backdoors or random number  generators and this research also based on the fourth injection based backdoors  in pseudo-random number generators. This research started within the  umbrella of the Hungarian NSA and right now we try to try to implement all of  the codes and this is the main reason we would like to show you how you can do it  and after the presentation you can also get the source code of these  algorithms and implementations. As you know OpenSSL there are  numerous open source applications that are using OpenSSL library and you know  for example OpenSSH age or curl, stunnel and all of these applications is very  important to emphasize that these applications are based on the secret of  OpenSSL so it means if you can make some backdoors in this library or you can  you can implement new techniques to this OpenSSL library after that there is a  chance to hide some backdoors. Of course it's not so easy because as you know  there are you know there are some checksums on the library and there are  many many differences how to prevent this kind of malicious activity. So the  main question is as I'm trying to try to show you in my presentation that is it  possible to hide the backdoor on a well-known algorithm. For example everybody  knows that RSA or AES is well known for security experts so it means that if you  would like to make some some white box with it for example in AES codes if you  know how does it work if you know what the algorithm is doing and you have some  test vectors it's very easy to identify the backdoors for example in an  encryption algorithm. It means as you can see in the slides for example you have  encryption key you have an initiation vector you have test vector and you have  a cipher text and if you know how AES algorithm is working on you can make  some tests. There is an input there is an output it's working or not if the  output is different than the sample or the text then it means that maybe there  is some backdoors on the AES algorithm or there is some programming mistakes on  the algorithm. So it means such kind of test vectors are proof of concepts that  modification have been made for example on the algorithm and it's very difficult  to hide a well-known backdoor in AES RSA or well known encryption algorithm. So  this was the main idea that modification an encryption algorithm is lead to a  non-sophisticated backdoor. So what about random number generators? As you know  there are no test vectors. It means because the behavior of the random  number generators is to produce true random numbers. Of course if you are  using only softwares not hardware if so no random number generators but of  course you can try to make very variable random numbers. However you have to use  some statistical tests like the National Institute standard of technology  tests or the die-hard tests in order to modify the output or in order to test  the output. If you would like to modify there is no test vectors it means as I  mentioned in the previous slides. If you are using AES there are test vectors and  it's working or not. In the random number generator methods because there are no  test vectors you cannot identify the malicious code on the random number  generators. Just figure out that's imaging that there is an embedded system  there are some hardware random number generation on the embedded system and  you don't know the source code. You know only the output of the random number  generator and if this random number generator passes all statistical  tests like the NIST test or die-hard test it should be good random number  generator and you cannot do nothing with this. So as you can see the main idea  how to modify pseudo random number generator for example in the open SSL  library in such a way that the modified output still passes all  statistical tests. I mean if I'm modifying the random number generator it  should pass all statistical tests. If not of course it's cryptographically  not secure. So this was the main idea and we tried to make some mathematical  background relating to this topic and we try to try to implement in the  practice. So the first one is just presented in some conferences and there  is a term that how to use this kind of mathematics relating to number towering  to hide some backdoors in pseudo random number generator and after that you  cannot identify the the backdoors in the random number generator. So as you can  see in the slide that let me define a pseudo random number generator and let  BI denote an IBitLens binary sequence and let us define the following function as  you can see. Fee BI and I wouldn't like to go into details but it's very  important to relate into this topic that's there is a term that's there  exists a polynomial time P algorithm with two of m periods and fee P BI EGAS 0 it  means and that's observing only two m minus one and consecutive bits from the  output of the pseudo random number generator it is possible to predict the  next bit with 100% of success. It's very important the next bit and 100% of  success. So it's it's very easy to create such kind of algorithm.  In the slides there is a proof of concept concept algorithms relating to the  AES it's called C self encryption AES and this is a POC proof of concept  algorithm and as you can see in the slides here is a seed he's an AS encryption  it's a combination of the counter mode and the CBC mode as you can see in the  slides so the output is shifted back and there is a new input for the next block.  As you can see that's I will call capital C because there is also a CI with this  one so capital C is this one and the C is only this one so capital CI plus one  you got to the encryption key of CI and it's as you can see or not see here is  the next one block and there is no loop in the algorithm so it means if I'm  using this kind of cycle and using this kind of counter mode it can be proved  that the size and length of the self encryption AS is minus two of 128 bits  and there is no loop in the counter mode in such a way as you know AES is  designed in such a way that try to pass all of known well known statistical  tests like the National Institute standard of technology test the NIST test or  the diehard test so it means if you are encrypting pseudo random number generator  output in such a way the output is always predictable and the output cannot be  distinguished from true random numbers only by statistical tests so if  you know the source code if you are know how this algorithm is working you can  predict the next bit with 100% of success however with only statistical test  I have to emphasize that only with statistical test you cannot distinguish  from two random numbers and it's very interesting relating to the proof of  this proof of concept algorithm that there is a very important corollary as  you can see in these slides so if you would like to observing how many bits  you have to observe in order to reconstruct the internal seed of the  random number generator you have to observe only 383 bits so it's not too  much to reconstruct the next bit so it means as you can see in this proof that  consecutive capital CI and CI plus 1 is 256 bits of course always can be found  in 383 bits if you just would like to to to image in this scannario there is a  slide there is a picture and you can check that's 258 bits always can be  found only 383 bits  relating to this one it's only just a proof of concept code so if someone  tried to implement these codes in open SSL library it's not as sophisticated  because if you have a white box on it and there is a security expert and  the security expert just try to check these combination of counter mond and  cbc mode of the AS algorithm he will definitely identify the malicious  activity in this encryption method however it's very interesting that we  just make some malware to modify the open SSL library and try to modify the  internal state of the prime number generation as you know if I'm trying to  modify the prime number generation for example in open SSL library after that  there are some statistical tests that have to pass the output so it means if  I'm doing some bad prime numbers and so on and so on after that they really won't  qualify and really don't want to pass his or statistical testing open SSL  library so you have to be very careful when you are modifying prime numbers  generation method of the open SSL library in this algorithm you can see  that it's a very interesting algorithm that's you are just searching prime  numbers less than the binary lengths of the number is 1024 so it means you just  multiply together prime numbers less than 100,000 and as maybe some of you  heard about that's in 1947 John Polard proved that is it possible to factorize  very large numbers in polynomial time if for example if it's prime factors  prime P-1 or P-1 has only small prime factors small prime factors means for  example less than 100,000 as we see in the previous section in this slide so it  means if somebody would like to make such kind of sophisticated backdoor  rating to prime number generation they can use for example these techniques to  to generate some prime numbers and after that we can check that how many how many  thank you okay so after that you just generated some prime numbers you can  test with NIST test and other sophisticated statistical test and  POS is all well-known statistical test it means any method that's implemented in  open-essertial library will not identify that any malicious background activity  is going on in the code in this slide you can see that just one you can see a  public key just we generated a public key with all modified open-essertial  library and after that we just published the public key to everybody and as you  know it's a 2048 it's public key and so it's almost infeasible to to factorize  however if you are using such kind of backdoors or you are if you are using  such kind of malicious random number generators is it possible to reconstruct  its prime numbers there is a mistyping this slide can you see it this is a  public key of the previous public key this is the decimal number of the n  modulus from this public key of course it is a base 64 encoded version of the  public key and this is the n modulus decimal number this is a 2048 bits  number and we just generated in such a way as I mentioned to you with John  Pollard techniques because we would like to reconstruct the private key from the  public key so I would like to emphasize that after that is it possible to  reconstruct the private key from the public key and of course if you are  using only statistical test you cannot find any malicious activity only in the  numbers because there are no such kind of activities going on if you know you  can also check on the internet that Polar's P-1 algorithm pseudo code as you  can see here the first step is threat as smooth as bound be I really wouldn't  like to get into details how to select these bound but after that there is a  very important part of the algorithm this one that the algorithm is running  till the time limit is not reached so it means have you ever tried to factorize  a very large number for example if it's large number it's more than 2000 bits it  means you try to factorize it and your computer is not working there is no  result nor is nor is that there is no result so it means you cannot factorize  it however as I mentioned to you and this number is it possible to factorize  this computer is factorized approximately eight minutes and is it possible  to reconstruct p and q prime numbers and if I'm choosing the smoothness be number  larger than 100,000 for example 1 million 10 million 100 million then it means the  factorization time is not eight minutes or not five minutes one hour one day one  week so it means if you are trying to to factorize a large number and there is no  result you don't know why is there is no result in the output because this is a  very secure huge number or there is a very large smooth number and generated in  such a way these numbers I really don't want you to to make explanation of this  algorithm you can find also in the internet we just used the combination  of this algorithm and the combination of the previous mentioned algorithm  self encryption AES to produce sophisticated and very good quality  random numbers in OpenSSL library. Of course relating to the huge decimal  number between one minutes corey seven laptop would found all of the prime  factors of the huge numbers so you can find p and q less than within one  minute so it means that is it possible to reconstruct from the public key the  private key and it's of course everybody knows that is a malicious activity can be  used in embedded system in web pages or when you are using some age or  something like that. Of course just some words relating to the new  randomness test that's when you are modifying the OpenSSL output that is  very well known statistical test that your generated numbers have to pass so it  means I'm just generating some bad numbers and they are not passes all  statistical tests from the National Institute standard of technology test it  means that these numbers are failed so you cannot use for cryptographic purposes  it's very well known. However we tested all of these all of the 15 and 16 and  17 tests it's there are some some extended tests in the niche test so all of  the 15 tests pass the output of the random number generation and after that  we tried to modify some other numbers. We tried different approaches also maybe  you have ever about sharkism of the theoretical tests we also applies the  well distribution this one and we also applied correlation measure this one  and after that we didn't identify any differences between two random numbers  and between the generated random numbers so we didn't find any statistical test  that can distinguish these bad numbers from good numbers. So after the  statistical test we try to implement risk an aerial and we try to  we try to make some some implementation of the code so we just you can see the  vkssl.com and we just requested this domain and we generated CSR and  sent to Commodore that we would like to HTTPS certification you know we would  like to use a second communication and we just request a certificate and  certificate issued by Commodore secuCA and this is a 2048 bits encryption  rating to the RSA as you know and it's very interesting that if you're a CA it's  not possible to identify any malicious activity in such kind of numbers because  you don't have enough researches to make factorization to find bad behaviors in  such kind of numbers so it means after that they approved and issued the  certificates we just deployed to vkssl.com you can check on your mobile  phone also vkssl.com is active and it's working of course you can check some  SSL uptests you maybe you know it that's we try to configure the server very  securely it means a plus one you know it's everything is enabled on the server  so it's very secure it seems to very secure as you can see TLS fiber core so  it's enabled and HTTPS forward secrecy is also enabled on the server so rating to  the security certificates everything is turned on and the server is seems very  secure rating to the certification and also certified by the Commodore. As you  can see in these slides just using some very basic comments in Linux for  example OpenSSL, ash client connects you can just download the certificate from  the server it's very easy you can download you can try it and after that  you can write out the modulus and you can write out from the certificates which  is the public key modulus this is the huge number and the next step is try to  factorize this number and we've written the source code in Parigipi it's a  computer algorithm system it's very easy to use every function you have to find  in relating to number theory you can very easy write some programs relating to  this topic and you can find some very cute stuff in this program as you can see  in the presentation and this this slide here is the modulus this is the large  2048 this number and you have to factorize it of course if you try to  factorize normal number it take more than a million years in a single computer so  it you cannot do this however this method is generated by our sophisticated  modified OpenSSL library and after that this is the polar p-1 algorithm  invited by John Pollard in 1974 just we wrote this program in Parigipi you can  see it's very short one and we just try to try to factorize the huge number this  one and as you can see it takes one minutes and 31 seconds within two  minutes we were able to to factorize the huge number and the certificate and it  means that is it possible to reconstruct from public key the private key and if  you see that just for example like in vk.shr.com that everything is secure the  certificate is certified by a very well-known CA and everything is configured  well maybe there is some some problem with the certificate also because you  can you can you can make some such kind of bad prime numbers that can be used in  such kind of certificates.  Summarizing the research it's very important to emphasize that kleptography  this is a so-called so theory of cryptography when you try to hide  information with cryptographic methods and try to steal information for  example from companies with cryptographic methods it's very well  known nowadays and we just modified OpenSSL library however you can use  this kind of methods in embedded system and it's very important to know that when  you are using some kleptographic methods and there is a white box on it a  security expert won't identify any malicious activity for example in a  source code and of course if you know that such kind of prime number generation  exist and you will see the source code you will know that there is some  problem with the prime numbers however if you know only the outputs for example  the certificate like in vkssl.com you don't have any clue how to factorize it  you don't have any clue how the prime numbers p and q generated so it means you  can make some backdoors you can implement some backdoors in such kind of  applications like SSH or certificates. This is a working member on Linux it means  that you can find the binaries of the OpenSSL and is it possible to to  modify the binaries and after that the prime number generation is malicious and  of course as I mentioned to you it's very important to emphasize that it is not  possible to distinguish my statistical tests so many many random number hardware  random number generation or software random number generation generator try  to try to approve in such a way that they try to analyze the output in this  way if you're trying to analyze the output it's not possible to distinguish  from other true random number generators. Okay thank you for your attention if you  have any question relating to random number generation or relating to the  source code I'm ready to answer it or we can also send to you in email to you  to try it or you can also try it to to  softwareansweekhssh.com or delizen.shh this is also weak in weakhssh.com thank you very much.  Does anybody have any questions that like to ask we have a few ministers there. Come on. Come on.  You must be very clear. Nothing. Ah that's one gentleman.  Sure question. How do you study the topic of manipulate the ECC generation through this thing?  Yeah you mean some problems relating to advanced know them and some some elliptic  curve generation methods. Yes as you know reacting to cryptography many huge  companies like NSA or or or Hulet Park arts or something like that's very huge  companies are using such kind of backdoors and it's very interesting  because when you are when you are identifying a backdoors relating to  kleptography you don't know it's it's really a backdoor or is just some  mistake in the mathematics programming. When I checked relating to elliptic curve  they are using that not the same techniques but some kleptographic  techniques how to hide some secret parameters relating to the elliptic  curve and after that they try to try to how can I say you know when you are  generating prime numbers we have some statistical prime numbers generator it  means there is a chance that is not a prime number but it's very highly likely  that is a prime number like million ruby interest or something like that and when  they are just generating some elliptic curve they just told everybody that it's  100% secure and it's 100% there is a little chance that is there is not on  the curve and something like that and after that some years ago it's they  identified that it's there is some problem with with the curves and this is  the same techniques relating to these other number theoretic groups like  elliptic curves so they are using maybe a more sophisticated backdoors and it's  you don't have such kind of research is you don't have many super computers  to analyze that is really a prime number this is really on the curve or  something like that and of course they have that research and they can make  such kind of sophisticated backdoors as I mentioned to you my computer takes  eight minutes to reconstruct from the public key the private key it means I  can choose a larger number and it takes eight days so when you are trying to  factorize after one day after two days you just finish it okay it's a very  secure number however if you try to run more than eight days you will find the  factors so this is the same if you don't have enough research is to find some  curves on the elliptic curves and find some secret parameters you think that  everything is secure on this random number generation however after that's  everybody try to find these secret parameters and everybody try to calculate  everything after that they found and realized that there is some problem with  the number generator okay thanks very much thank you very much
NorbertTihanyiAmodificationoftheprime_0_47.png NorbertTihanyiAmodificationoftheprime_48_887.png NorbertTihanyiAmodificationoftheprime_888_1535.png NorbertTihanyiAmodificationoftheprime_1536_2123.png NorbertTihanyiAmodificationoftheprime_2124_3107.png NorbertTihanyiAmodificationoftheprime_3108_3275.png NorbertTihanyiAmodificationoftheprime_3276_4499.png NorbertTihanyiAmodificationoftheprime_4500_6815.png NorbertTihanyiAmodificationoftheprime_6816_6923.png NorbertTihanyiAmodificationoftheprime_6924_9971.png NorbertTihanyiAmodificationoftheprime_9972_12239.png NorbertTihanyiAmodificationoftheprime_12240_15539.png NorbertTihanyiAmodificationoftheprime_15540_17651.png NorbertTihanyiAmodificationoftheprime_17652_18035.png NorbertTihanyiAmodificationoftheprime_18036_19823.png NorbertTihanyiAmodificationoftheprime_19824_20399.png NorbertTihanyiAmodificationoftheprime_20400_20531.png NorbertTihanyiAmodificationoftheprime_20532_22019.png NorbertTihanyiAmodificationoftheprime_22020_23219.png NorbertTihanyiAmodificationoftheprime_23220_23471.png NorbertTihanyiAmodificationoftheprime_23472_23519.png NorbertTihanyiAmodificationoftheprime_23520_23603.png NorbertTihanyiAmodificationoftheprime_23604_23747.png NorbertTihanyiAmodificationoftheprime_23748_24611.png NorbertTihanyiAmodificationoftheprime_24612_25895.png NorbertTihanyiAmodificationoftheprime_25896_26171.png NorbertTihanyiAmodificationoftheprime_26172_27671.png NorbertTihanyiAmodificationoftheprime_27672_28655.png NorbertTihanyiAmodificationoftheprime_28656_28703.png NorbertTihanyiAmodificationoftheprime_28704_29231.png NorbertTihanyiAmodificationoftheprime_29232_29327.png NorbertTihanyiAmodificationoftheprime_29328_29699.png NorbertTihanyiAmodificationoftheprime_29700_29807.png NorbertTihanyiAmodificationoftheprime_29808_29975.png NorbertTihanyiAmodificationoftheprime_29976_30107.png NorbertTihanyiAmodificationoftheprime_30108_31163.png NorbertTihanyiAmodificationoftheprime_31164_32999.png NorbertTihanyiAmodificationoftheprime_33000_33863.png NorbertTihanyiAmodificationoftheprime_33864_34787.png NorbertTihanyiAmodificationoftheprime_34788_37679.png NorbertTihanyiAmodificationoftheprime_37680_40475.png NorbertTihanyiAmodificationoftheprime_40476_40823.png NorbertTihanyiAmodificationoftheprime_40824_46091.png NorbertTihanyiAmodificationoftheprime_46092_46186.png
Welcome ladies and gentlemen. My name is Norbert Ianni and I was working for the Hungarian SA more than seven years and I was responsible to make penetration testing and trip analysis and we do some some researches relating to prime number theory and right now I'm a senior secretary advisor at a Hungarian company. As you can see my t-shirt this is a green t-shirt. As you know we didn't have such kind of cool t-shirt in the Hungarian SA so maybe this was the first reason why I just left the company. In this presentation I'm just would like to show you how to hide some backdoors and how to make some malicious code or random number generations methods and how to identify these codes and after that how to implement in practice these backdoors and applications on prime number generation methods and in backdoors of random number generations. The general background of the research can be shown in these slides and the main concept of this presentation is based on the following researches that you can see in the slides. Sight-tune-up, cryptography, pseudo-random generation and this presentation also presented in the Central European Conference on Cryptology in Budapest. We went into the Mathematica background and right now we implemented the code and right now we would like to show you how to implement in the real practice and how to make some fake certificate how to implement some sophisticated backdoors or random number generators and this research also based on the fourth injection based backdoors in pseudo-random number generators. This research started within the umbrella of the Hungarian NSA and right now we try to try to implement all of the codes and this is the main reason we would like to show you how you can do it and after the presentation you can also get the source code of these algorithms and implementations. As you know OpenSSL there are numerous open source applications that are using OpenSSL library and you know for example OpenSSH age or curl, stunnel and all of these applications is very important to emphasize that these applications are based on the secret of OpenSSL so it means if you can make some backdoors in this library or you can you can implement new techniques to this OpenSSL library after that there is a chance to hide some backdoors. Of course it's not so easy because as you know there are you know there are some checksums on the library and there are many many differences how to prevent this kind of malicious activity. So the main question is as I'm trying to try to show you in my presentation that is it possible to hide the backdoor on a well-known algorithm. For example everybody knows that RSA or AES is well known for security experts so it means that if you would like to make some some white box with it for example in AES codes if you know how does it work if you know what the algorithm is doing and you have some test vectors it's very easy to identify the backdoors for example in an encryption algorithm. It means as you can see in the slides for example you have encryption key you have an initiation vector you have test vector and you have a cipher text and if you know how AES algorithm is working on you can make some tests. There is an input there is an output it's working or not if the output is different than the sample or the text then it means that maybe there is some backdoors on the AES algorithm or there is some programming mistakes on the algorithm. So it means such kind of test vectors are proof of concepts that modification have been made for example on the algorithm and it's very difficult to hide a well-known backdoor in AES RSA or well known encryption algorithm. So this was the main idea that modification an encryption algorithm is lead to a non-sophisticated backdoor. So what about random number generators? As you know there are no test vectors. It means because the behavior of the random number generators is to produce true random numbers. Of course if you are using only softwares not hardware if so no random number generators but of course you can try to make very variable random numbers. However you have to use some statistical tests like the National Institute standard of technology tests or the die-hard tests in order to modify the output or in order to test the output. If you would like to modify there is no test vectors it means as I mentioned in the previous slides. If you are using AES there are test vectors and it's working or not. In the random number generator methods because there are no test vectors you cannot identify the malicious code on the random number generators. Just figure out that's imaging that there is an embedded system there are some hardware random number generation on the embedded system and you don't know the source code. You know only the output of the random number generator and if this random number generator passes all statistical tests like the NIST test or die-hard test it should be good random number generator and you cannot do nothing with this. So as you can see the main idea how to modify pseudo random number generator for example in the open SSL library in such a way that the modified output still passes all statistical tests. I mean if I'm modifying the random number generator it should pass all statistical tests. If not of course it's cryptographically not secure. So this was the main idea and we tried to make some mathematical background relating to this topic and we try to try to implement in the practice. So the first one is just presented in some conferences and there is a term that how to use this kind of mathematics relating to number towering to hide some backdoors in pseudo random number generator and after that you cannot identify the the backdoors in the random number generator. So as you can see in the slide that let me define a pseudo random number generator and let BI denote an IBitLens binary sequence and let us define the following function as you can see. Fee BI and I wouldn't like to go into details but it's very important to relate into this topic that's there is a term that's there exists a polynomial time P algorithm with two of m periods and fee P BI EGAS 0 it means and that's observing only two m minus one and consecutive bits from the output of the pseudo random number generator it is possible to predict the next bit with 100% of success. It's very important the next bit and 100% of success. So it's it's very easy to create such kind of algorithm. In the slides there is a proof of concept concept algorithms relating to the AES it's called C self encryption AES and this is a POC proof of concept algorithm and as you can see in the slides here is a seed he's an AS encryption it's a combination of the counter mode and the CBC mode as you can see in the slides so the output is shifted back and there is a new input for the next block. As you can see that's I will call capital C because there is also a CI with this one so capital C is this one and the C is only this one so capital CI plus one you got to the encryption key of CI and it's as you can see or not see here is the next one block and there is no loop in the algorithm so it means if I'm using this kind of cycle and using this kind of counter mode it can be proved that the size and length of the self encryption AS is minus two of 128 bits and there is no loop in the counter mode in such a way as you know AES is designed in such a way that try to pass all of known well known statistical tests like the National Institute standard of technology test the NIST test or the diehard test so it means if you are encrypting pseudo random number generator output in such a way the output is always predictable and the output cannot be distinguished from true random numbers only by statistical tests so if you know the source code if you are know how this algorithm is working you can predict the next bit with 100% of success however with only statistical test I have to emphasize that only with statistical test you cannot distinguish from two random numbers and it's very interesting relating to the proof of this proof of concept algorithm that there is a very important corollary as you can see in these slides so if you would like to observing how many bits you have to observe in order to reconstruct the internal seed of the random number generator you have to observe only 383 bits so it's not too much to reconstruct the next bit so it means as you can see in this proof that consecutive capital CI and CI plus 1 is 256 bits of course always can be found in 383 bits if you just would like to to to image in this scannario there is a slide there is a picture and you can check that's 258 bits always can be found only 383 bits relating to this one it's only just a proof of concept code so if someone tried to implement these codes in open SSL library it's not as sophisticated because if you have a white box on it and there is a security expert and the security expert just try to check these combination of counter mond and cbc mode of the AS algorithm he will definitely identify the malicious activity in this encryption method however it's very interesting that we just make some malware to modify the open SSL library and try to modify the internal state of the prime number generation as you know if I'm trying to modify the prime number generation for example in open SSL library after that there are some statistical tests that have to pass the output so it means if I'm doing some bad prime numbers and so on and so on after that they really won't qualify and really don't want to pass his or statistical testing open SSL library so you have to be very careful when you are modifying prime numbers generation method of the open SSL library in this algorithm you can see that it's a very interesting algorithm that's you are just searching prime numbers less than the binary lengths of the number is 1024 so it means you just multiply together prime numbers less than 100,000 and as maybe some of you heard about that's in 1947 John Polard proved that is it possible to factorize very large numbers in polynomial time if for example if it's prime factors prime P-1 or P-1 has only small prime factors small prime factors means for example less than 100,000 as we see in the previous section in this slide so it means if somebody would like to make such kind of sophisticated backdoor rating to prime number generation they can use for example these techniques to to generate some prime numbers and after that we can check that how many how many thank you okay so after that you just generated some prime numbers you can test with NIST test and other sophisticated statistical test and POS is all well-known statistical test it means any method that's implemented in open-essertial library will not identify that any malicious background activity is going on in the code in this slide you can see that just one you can see a public key just we generated a public key with all modified open-essertial library and after that we just published the public key to everybody and as you know it's a 2048 it's public key and so it's almost infeasible to to factorize however if you are using such kind of backdoors or you are if you are using such kind of malicious random number generators is it possible to reconstruct its prime numbers there is a mistyping this slide can you see it this is a public key of the previous public key this is the decimal number of the n modulus from this public key of course it is a base 64 encoded version of the public key and this is the n modulus decimal number this is a 2048 bits number and we just generated in such a way as I mentioned to you with John Pollard techniques because we would like to reconstruct the private key from the public key so I would like to emphasize that after that is it possible to reconstruct the private key from the public key and of course if you are using only statistical test you cannot find any malicious activity only in the numbers because there are no such kind of activities going on if you know you can also check on the internet that Polar's P-1 algorithm pseudo code as you can see here the first step is threat as smooth as bound be I really wouldn't like to get into details how to select these bound but after that there is a very important part of the algorithm this one that the algorithm is running till the time limit is not reached so it means have you ever tried to factorize a very large number for example if it's large number it's more than 2000 bits it means you try to factorize it and your computer is not working there is no result nor is nor is that there is no result so it means you cannot factorize it however as I mentioned to you and this number is it possible to factorize this computer is factorized approximately eight minutes and is it possible to reconstruct p and q prime numbers and if I'm choosing the smoothness be number larger than 100,000 for example 1 million 10 million 100 million then it means the factorization time is not eight minutes or not five minutes one hour one day one week so it means if you are trying to to factorize a large number and there is no result you don't know why is there is no result in the output because this is a very secure huge number or there is a very large smooth number and generated in such a way these numbers I really don't want you to to make explanation of this algorithm you can find also in the internet we just used the combination of this algorithm and the combination of the previous mentioned algorithm self encryption AES to produce sophisticated and very good quality random numbers in OpenSSL library. Of course relating to the huge decimal number between one minutes corey seven laptop would found all of the prime factors of the huge numbers so you can find p and q less than within one minute so it means that is it possible to reconstruct from the public key the private key and it's of course everybody knows that is a malicious activity can be used in embedded system in web pages or when you are using some age or something like that. Of course just some words relating to the new randomness test that's when you are modifying the OpenSSL output that is very well known statistical test that your generated numbers have to pass so it means I'm just generating some bad numbers and they are not passes all statistical tests from the National Institute standard of technology test it means that these numbers are failed so you cannot use for cryptographic purposes it's very well known. However we tested all of these all of the 15 and 16 and 17 tests it's there are some some extended tests in the niche test so all of the 15 tests pass the output of the random number generation and after that we tried to modify some other numbers. We tried different approaches also maybe you have ever about sharkism of the theoretical tests we also applies the well distribution this one and we also applied correlation measure this one and after that we didn't identify any differences between two random numbers and between the generated random numbers so we didn't find any statistical test that can distinguish these bad numbers from good numbers. So after the statistical test we try to implement risk an aerial and we try to we try to make some some implementation of the code so we just you can see the vkssl.com and we just requested this domain and we generated CSR and sent to Commodore that we would like to HTTPS certification you know we would like to use a second communication and we just request a certificate and certificate issued by Commodore secuCA and this is a 2048 bits encryption rating to the RSA as you know and it's very interesting that if you're a CA it's not possible to identify any malicious activity in such kind of numbers because you don't have enough researches to make factorization to find bad behaviors in such kind of numbers so it means after that they approved and issued the certificates we just deployed to vkssl.com you can check on your mobile phone also vkssl.com is active and it's working of course you can check some SSL uptests you maybe you know it that's we try to configure the server very securely it means a plus one you know it's everything is enabled on the server so it's very secure it seems to very secure as you can see TLS fiber core so it's enabled and HTTPS forward secrecy is also enabled on the server so rating to the security certificates everything is turned on and the server is seems very secure rating to the certification and also certified by the Commodore. As you can see in these slides just using some very basic comments in Linux for example OpenSSL, ash client connects you can just download the certificate from the server it's very easy you can download you can try it and after that you can write out the modulus and you can write out from the certificates which is the public key modulus this is the huge number and the next step is try to factorize this number and we've written the source code in Parigipi it's a computer algorithm system it's very easy to use every function you have to find in relating to number theory you can very easy write some programs relating to this topic and you can find some very cute stuff in this program as you can see in the presentation and this this slide here is the modulus this is the large 2048 this number and you have to factorize it of course if you try to factorize normal number it take more than a million years in a single computer so it you cannot do this however this method is generated by our sophisticated modified OpenSSL library and after that this is the polar p-1 algorithm invited by John Pollard in 1974 just we wrote this program in Parigipi you can see it's very short one and we just try to try to factorize the huge number this one and as you can see it takes one minutes and 31 seconds within two minutes we were able to to factorize the huge number and the certificate and it means that is it possible to reconstruct from public key the private key and if you see that just for example like in vk.shr.com that everything is secure the certificate is certified by a very well-known CA and everything is configured well maybe there is some some problem with the certificate also because you can you can you can make some such kind of bad prime numbers that can be used in such kind of certificates. Summarizing the research it's very important to emphasize that kleptography this is a so-called so theory of cryptography when you try to hide information with cryptographic methods and try to steal information for example from companies with cryptographic methods it's very well known nowadays and we just modified OpenSSL library however you can use this kind of methods in embedded system and it's very important to know that when you are using some kleptographic methods and there is a white box on it a security expert won't identify any malicious activity for example in a source code and of course if you know that such kind of prime number generation exist and you will see the source code you will know that there is some problem with the prime numbers however if you know only the outputs for example the certificate like in vkssl.com you don't have any clue how to factorize it you don't have any clue how the prime numbers p and q generated so it means you can make some backdoors you can implement some backdoors in such kind of applications like SSH or certificates. This is a working member on Linux it means that you can find the binaries of the OpenSSL and is it possible to to modify the binaries and after that the prime number generation is malicious and of course as I mentioned to you it's very important to emphasize that it is not possible to distinguish my statistical tests so many many random number hardware random number generation or software random number generation generator try to try to approve in such a way that they try to analyze the output in this way if you're trying to analyze the output it's not possible to distinguish from other true random number generators. Okay thank you for your attention if you have any question relating to random number generation or relating to the source code I'm ready to answer it or we can also send to you in email to you to try it or you can also try it to to softwareansweekhssh.com or delizen.shh this is also weak in weakhssh.com thank you very much. Does anybody have any questions that like to ask we have a few ministers there. Come on. Come on. You must be very clear. Nothing. Ah that's one gentleman. Sure question. How do you study the topic of manipulate the ECC generation through this thing? Yeah you mean some problems relating to advanced know them and some some elliptic curve generation methods. Yes as you know reacting to cryptography many huge companies like NSA or or or Hulet Park arts or something like that's very huge companies are using such kind of backdoors and it's very interesting because when you are when you are identifying a backdoors relating to kleptography you don't know it's it's really a backdoor or is just some mistake in the mathematics programming. When I checked relating to elliptic curve they are using that not the same techniques but some kleptographic techniques how to hide some secret parameters relating to the elliptic curve and after that they try to try to how can I say you know when you are generating prime numbers we have some statistical prime numbers generator it means there is a chance that is not a prime number but it's very highly likely that is a prime number like million ruby interest or something like that and when they are just generating some elliptic curve they just told everybody that it's 100% secure and it's 100% there is a little chance that is there is not on the curve and something like that and after that some years ago it's they identified that it's there is some problem with with the curves and this is the same techniques relating to these other number theoretic groups like elliptic curves so they are using maybe a more sophisticated backdoors and it's you don't have such kind of research is you don't have many super computers to analyze that is really a prime number this is really on the curve or something like that and of course they have that research and they can make such kind of sophisticated backdoors as I mentioned to you my computer takes eight minutes to reconstruct from the public key the private key it means I can choose a larger number and it takes eight days so when you are trying to factorize after one day after two days you just finish it okay it's a very secure number however if you try to run more than eight days you will find the factors so this is the same if you don't have enough research is to find some curves on the elliptic curves and find some secret parameters you think that everything is secure on this random number generation however after that's everybody try to find these secret parameters and everybody try to calculate everything after that they found and realized that there is some problem with the number generator okay thanks very much thank you very much
applications on prime number generation methods this presentation is based on the following Sight-tune-up, cryptography, pseudo-random checksums on the library and there are many many possible to hide the backdoor on a well-known passes all statistical tests like the NIST test numbers generation method of the open SSL library just published the public key to everybody and as number generators is it possible to reconstruct to reconstruct the private key from the public failed so you cannot use for cryptographic by our sophisticated modified OpenSSL library and kind of bad prime numbers that can be used in research it's very important to emphasize that kleptography this is a so-called so theory of the prime number generation is malicious and of