Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What encryption algorithms should we take as compromised?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 49 posts

Re: Ask HN: What encryption algorithms should we take as compromised?

#11

Post by yk »

Both Snowden and Schneier said something to the effect of "trust the math." [1,2] Additionally the leaked Tor presentation [3] seems to indicate, that the NSA can not break the primitives used in Tor. So the algorithms that were considered secure before the Snowden leaks seem to be secure. ( But this is purely a statement about algorithms, you still need to use a well studied and tested implementation of these.)

[1] Schneier: http://www.theguardian.com/world/2013/sep/05/nsa-how-to-rema...

[2] Snowden: http://www.theregister.co.uk/2014/03/10/snowden_a_few_good_d...

[3] http://www.theguardian.com/world/interactive/2013/oct/04/tor...

Re: Ask HN: What encryption algorithms should we take as compromised?

#13

Post by netdog »

silenteh wrote: post #9

In general you should prefer crypto constructions which are a result of global competitions. For example AES and SHA3. You should avoid at all costs anything that has been standardized by NIST without going through years of reviews by international cryptographers. Dual_EC_DRBG is a clear example of crypto construction which falls into this category. This is my general rule of thumb. However knowing which ciphers one…

> In general you should prefer crypto constructions which are a result of global competitions. For example AES and SHA3.

The judges who chose AES and SHA-3 as the "winners" of the global competitions are the NSA.

> You should avoid at all costs anything that has been standardized by NIST...

That would include AES and SHA-3.

Re: Ask HN: What encryption algorithms should we take as compromised?

#16

Post by dfa0 »

Ciphers to avoid DSS, MD5/RC4, SHA-1.

Ciphers to prefer ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256

A pretty good source/guide:

https://hynek.me/articles/hardening-your-web-servers-ssl-cip...

You'll need apache 2.4+[I think], or nginx. And possibly fresh certs to use DHE/EC.

A quick rundown of a fairly secure setup:

Cipher Priority list:

ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:!RSA+3DES:!aNULL:!MD5:!DSS:!SHA:AEAD

==========================================================

Generate the cert and private key:

openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:4096 -keyout serverkey.pem -out servercert.pem

==========================================================

Generate the DH parameters:

openssl dhparam -out dh2048.pem -outform PEM -2 2048

==========================================================

How to List Elliptic Curves:

openssl ecparam -list_curves

===========================================================

Note: Generating DH parameters is gonna take a while. If you are implementing this on a slowish machine like a Raspberry Pi, you might want to use a faster machine to do the DH step, then copy file the key over.

Re: Ask HN: What encryption algorithms should we take as compromised?

#17

Post by silenteh »

netdog wrote: post #13
silenteh wrote: post #9

In general you should prefer crypto constructions which are a result of global competitions. For example AES and SHA3. You should avoid at all costs anything that has been standardized by NIST without going through years of reviews by international cryptographers. Dual_EC_DRBG is a clear example of crypto construction which falls into this category. This is my general rule of thumb. However knowing which ciphers one…

> In general you should prefer crypto constructions which are a result of global competitions. For example AES and SHA3. The judges who chose AES and SHA-3 as the "winners" of the global competitions are the NSA. > You should avoid at all costs anything that has been standardized by NIST... That would include AES and SHA-3.

> The judges who chose AES and SHA-3 as the "winners" of the global competitions are the NSA.

Sure, however this process creates alternatives and if the crypto community thinks the winner is backdoored I am pretty sure we will know it and additionally we will have a valid alternative ready to be implemented. Additionally if the NSA/NIST modifies the specs for the crypto construction there is still the possibility to implement the original one. See SHA-3 for instance. It was about to be weakened, but the crypto community could still implement the original spec.

> That would include AES and SHA-3.

You cut the rest of the sentence and therefore changed completely the whole meaning. My original sentence included: "...without going through years of reviews by international cryptographers." Take a look at this video of D.J.B.: https://www.youtube.com/watch?v=G-TM9ubxKIg He makes a great example with the Dual_EC_DRBG, where many cryptographers told NIST that there could be a backdoor. NIST answer basically was: sorry too late, it has already been implemented !

So in other words, in case of Dual_EC_DRBG the standardization process was all in reverse. First NIST standardized it and then the crypto community started to review it and found problems.

Re: Ask HN: What encryption algorithms should we take as compromised?

#19

Post by elliotz »

acqq wrote: post #8
pja wrote: post #2

No ssh2-rsa is not known to be broken, although it's suspected that the NSA can factor some small ( It's believed that any elliptic curve algorithm that doesn't have a transparent process for choosing the curve points may have been backdoored by the NSA choosing points that they already knew how to factor. If you use those curves, then you're revealing your secrets to the NSA but not to anyone else, because the discr…

> If you use those curves, then you're revealing your secrets to the NSA but not to anyone else. ...until some worker or contractor takes their "secret" values for himself, or sells them, or publishes them on the internet. Producing the public standards with the built-in master keys increases possibility of overnight global breakage.

The public standard shouldn't include the secret values, but rather identify the (verifiable) process for generating the public values, in order to assure people that they were not created from secret values.

See: https://en.wikipedia.org/wiki/Nothing_up_my_sleeve_number

(Or, of course, you could just not publish RNG standards based on public-key crypto ;-)

Re: Ask HN: What encryption algorithms should we take as compromised?

#20

Post by tptacek »

vbuterin wrote: post #18

SHA256, SHA3, AES, ECDSA and ECDH/ECIES are all good, plus one-time pads and Shamir's secret sharing. There's no real need to use anything else.

SHA256 is an instance of SHA2. Presumably you didn't mean that SHA512 was bad, or, better, SHA512/256.

ECDSA, ECDH, and ECIES (which we don't see a lot of) all require a curve. Saying "ECDH is good" isn't helpful if you can't safely choose a curve to run them over.

ECDSA has another problem: it has a hard randomness requirement. If you repeat the per-message nonce, leak bits of the message nonce, or even fail to fill the modulus for the message nonce, you set up a condition where attackers can recover your private key. DJB is trying to push ECDSA into disfavor, replacing it with deterministic signatures.

One-time pads are awful and should be avoided at all costs. Virtually every computer program developed by generalist programmers that claimed to be a "one-time pad" was instead a crappy stream cipher.

Shamir splitting is fine, although that's a strange thing to have in your "regular use" bag.

Post reply on HN