1. Ensuring Sufficient Entropy in RSA Modulus Generation Wendy Mu Henry Corrigan-Gibbs Dan Boneh

2. Motivation #1

3. A study by Heninger et al. (2012) found… 5.57% of TLS hosts had same private keys as another host 0.50% of these hosts’ private keys were easily computed through finding all-pairs GCDs

4. Motivation #1 Reason for these common factors? Weak entropy!

5. Motivation #2

6. Goals

7. Overview Entropy Authority Certificate Authority TLS Host (e.g., web server) Key generation protocol Key verification protocol

8. Overview Entropy Authority Certificate Authority TLS Host (e.g., web server) 3. EA-signed certificate 2. EA-signed certificate 1. Modulus generation 4. CA-signed certificate

9. Building blocks

11. Public-key signature scheme (Goldwasser et al.) Sign and verify functions Existentially unforgeable

12. Protocol: Modulus Generation HostEntropy Authority

13. Protocol: Modulus Generation HostEntropy Authority

14. Protocol: Modulus Verification HostCertificate Authority Verify EA signature

15. Application: SSH Entropy Authority SSH Client SSH Server 3. EA-signed certificate 2. EA-signed certificate 1. Modulus generation

16. Security

22. Performance On a laptop… Traditional RSA: 0.59s Our protocol: 3.18s

23. Performance On a Linksys router… Traditional RSA: 59.6s Our protocol: 111.7s Includes ~100ms RTT network latency Relatively small overhead: ~2x

24. Related Work

25. Future work Integrate protocol into certificate signing request to CA

26. Conclusion Protocol for generating an RSA modulus with sufficient randomness Feasible to implement on today’s hardware Small overhead to traditional RSA Contact: wmu@cs.stanford.edu