Holy crap. Gemalto's IDPrime.NET cards - the ones they tout being Windows native compatible - are suscept. to factorization.

External Tweet loading...
If nothing shows, it may have been deleted
by @mndell view original on Twitter

1) Researchers have found a process to duplicate a PRIVATE key just from the PUBLIC key. This is big.

And cheap, for a 1024bit key.

2) Gemalto are a large mfgr of smartcards. Their IDPrime.Net cards are popular because they work with Windows w/o extra software

Gemalto say their product line, which is used in huge environments like Microsoft, *may* be affected.

"It MAY be possible to determine the lock combination to your SafeCo Safe with $40 of AWS time and a pic of the locked door." 😳😳😳🤦‍♂️

But this... this is the pièce de résistance:

Gemalto cards from 2008+ are susceptible. (I'm unclear if this is only applicable to the IDPrime.Net line.). That's huge, but..

A few weeks later, different researchers optimize the factorization algo and get a 25% efficiency boost! Just by reading the original paper.

But alas, their work is for nought, as the original authors had already written a new algo that is 4x better.

So, to recap....

Massive smartcard maker says their encryption/MFA products *may* be reversable just from the public key (which is pretty bad)

Researchers already have a 4x improvement on their PoC code, and the number crunching can be done on cheap cloud time or a GPU crypto rig.

As a former #HPC guy turned #GRC, this is fascinating, astounding, super cool, and very bad, all rolled in one.

Curious to see whats next!