Слабые ключи в криптографии: уязвимости и примеры

In cryptography, a weak key is a key, which, used with a specific cipher, makes the cipher behave in some undesirable way. Weak keys usually represent a very small fraction of the overall keyspace, which usually means that, a cipher key made by random number generation is very unlikely to give rise to a security problem. Nevertheless, it is considered desirable for a cipher to have no weak keys. A cipher with no weak keys is said to have a flat, or linear, key space.

Virtually all rotor based cipher machines (from 1925 onwards) have implementation flaws that lead to a substantial number of weak keys being created. Some rotor machines have more problems with weak keys than others, as modern block and stream ciphers do. The first stream cipher machines were also rotor machines and had some of the same problems of weak keys as the more traditional rotor machines. The T52 was one such stream cipher machine that had weak key problems. The British first detected T52 traffic in Summer and Autumn of 1942. One link was between Sicily and Libya, codenamed "Sturgeon", and another from the Aegean to Sicily, codenamed "Mackerel". Operators of both links were in the habit of enciphering several messages with the same machine settings, producing large numbers of depths. There were several (mostly incompatible) versions of the T52: the T52a and T52b (which differed only in their electrical noise suppression), T52c, T52d and T52e. While the T52a/b and T52c were cryptologically weak, the last two were more advanced devices; the movement of the wheels was intermittent, the decision on whether or not to advance them being controlled by logic circuits which took as input data from the wheels themselves. In addition, a number of conceptual flaws (including very subtle ones) had been eliminated. One such flaw was the ability to reset the keystream to a fixed point, which led to key reuse by undisciplined machine operators.

DES, as detailed above. RC4. RC4's weak initialization vectors allow an attacker to mount a known plaintext attack and have been widely used to compromise the security of WEP and ARC4 DMRA DMR. IDEA. IDEA's weak keys are identifiable in a chosen plaintext attack. They make the relationship between the XOR sum of plaintext bits and ciphertext bits predictable. There is no list of these keys, but they can be identified by their "structure". Blowfish. Blowfish's weak keys produce bad S boxes, since Blowfish's S boxes are key dependent. There is a chosen plaintext attack against a reduced round variant of Blowfish that is made easier by the use of weak keys. This is not a concern for full 16 round Blowfish. GMAC. Frequently used in the AES GCM construction. Weak keys can be identified by the group order of the authentication key H (for AES GCM, H is derived from the encryption key by encrypting the zero block). RSA and DSA. August 2012 Nadia Heninger, Zakir Durumeric, Eric Wustrow, J. Alex Halderman found that TLS certificates they assessed share keys due to insufficient entropy during key generation, and were able to obtain DSA and RSA private keys of TLS and SSH hosts knowing only the public key.