RSA Hacked - SecurID Information Exposed

EMC's RSA division announced that they had been hacked and it appears that they're doing the right thing for their customers by telling them. From their announcement:

"Our investigation also revealed that the attack resulted in certain information being extracted from RSA's systems. Some of that information is specifically related to RSA's SecurID two-factor authentication products. While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers, this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack."

If you're a current SecurID customer, you'll likely want to keep track of this as further detail is released. RSA notes that they expect to release details to the community -

"As appropriate, we will share our experiences from these attacks with our customers, partners and the rest of the security vendor ecosystem and work in concert with these organizations to develop means to better protect all of us from these growing and ever more sophisticated forms of cyber security threat."

I'll post further detail as it becomes available.

Crypto Cracking: RSA 768 Factored

When I cover cryptography for security professionals, I always discuss bad choices in cryptographic solutions: designing your own cryptosystem, choosing a bad mode, and of course, too short of a key length. The good news is that scientists continue to pursue key cracks, providing great fodder for my teaching efforts.

The key length question in particular is interesting, as we continue to see higher and higher key lengths broken in widely used crypto systems. The most recent hurdle to fall is RSA 768, which was cracked using a number field sieve by an international team. The good news for those who have critical secrets encrypted with 768 bit keys is that this was a multi-year effort - we're not to the point where we can do commodity cracking of RSA keys of that length yet.

Interestingly, the techniques used significantly decrease the effort required to derive the key - the Register article describes a "thousands" of times more difficult effort than the signficantly greater effort that the key size alone would indicate. This makes teaching students about key length trickier - but it also means that explaining why key length alone is not the only factor to consider is important.