Archive for May, 2007

Shall we say… you’re hacked!

Tuesday, May 29th, 2007

The major banks and security agencies currently use what’s call an RSA 1024bit encryption for secure transaction etc.  Basically, the server has a public key which is freely transmitted via the net while the client holds a private key which are the prime numbers (non-divisible factors) of the public key.  Only client hold the private keys.  The trick on hackinginto the system is to decipher or brute-forcely firgure out the prime numbers by factoring a large number.  Recently, a team of mathematicians has set a new record for factoring a large
number into primes, breaking a massive 307-digit number into its three
indivisible factors and beating the previous record by 30 digits.  When translated into bits (1s and 0s), it’s an astounding 1017-bit encryption, meaning if you got anything less than 1024 encryption, their algorithm will break it. 

The new trick/breakthrough is at the distributed computing level, by taking advantage of computers NOT all at the same facility but anywhere on the planet.  One could easily see if a hacker could gain control of large number of computing power across the globe, he/she could almost break into anything.  Specifically, the gaming consoles such as the late PlayStation3 are optimized for number crunching and the fact that they’re networked make them easy targets. A quick "borrowing" of  a swarm of PS3s would crack open a secure network within minutes. 

It took the team of scientists 95 CPU years to crack open the 1017-bit number, which  is equivalent to 3Billion CPU floating operations (flops) seconds.  The latest tally suggests over 5Million PS3s sold and assuming about 3 millions are networked, it would only take about 16-20 minutes to crack open any secure connection!
But… don’t be too worried, it’s easy to up the encryption number. In fact, the 1024 encryption was upgraded from the previous 512-bit encryption when a similar algorithm was developed in 1999.

Reference: http://sciencenow.sciencemag.org/cgi/content/full/2007/523/1