Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What encryption algorithms should we take as compromised?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 49 posts

Re: Ask HN: What encryption algorithms should we take as compromised?

#21

Post by tptacek »

"SSH2-RSA" isn't an encryption algorithm. It's a description of the SSH protocol using RSA authentication.

It is easier to provide the list of things that are worth worrying about than it is to list the things that are safe. There are a lot of as-yet unbroken ciphers and constructions. So, here are the things to avoid:

* Block ciphers in the default mode ("ECB").

* The Dual_EC random number generator, which virtually nobody uses anyways. You weren't going to accidentally end up using it. Or, for that matter, any other PKRNG (random numbers produced by public key algorithms).

* RSA with 1024 bit moduli (or below); RSA-2048 is your starting point. Conventional DH at similar key sizes will be an issue too, but there's a "means/motive/opportunity" issue for RSA-1024 given its prevalence.

* MD4, MD5, and SHA1 aren't backdoored, but are broken or weak. But: all three are survivable in HMAC (don't use them, though). SHA2 is your best all-around hashing bet right now.

* The NIST P- curves. There's no evidence to suggest they're backdoored, but (a) the rationale behind their generation is questionable and (b) they have other annoying properties.

So far as I can tell, you are now fully briefed on the "distrusted" crypto.

Don't build your own crypto. Use PGP for data at rest, TLS for data in motion, and NaCl for the rare in-between cases.

Re: Ask HN: What encryption algorithms should we take as compromised?

#22

Post by snowwrestler »

dfa0 wrote: post #16

Ciphers to avoid DSS, MD5/RC4, SHA-1. Ciphers to prefer ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256 A pretty good source/guide: https://hynek.me/articles/hardening-your-web-servers-ssl-cip... You'll need apache 2.4+[I think], or nginx. And possibly fresh certs to use DHE/EC. A quick rundown of a fairly secure setup: Cipher Priority list: ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!ECDH+3DES:DH+3DE…

Note to the mods: this comment breaks formatting on mobile, forcing the min page width to be much wider than usual and even more difficult to read on a phone.

Re: Ask HN: What encryption algorithms should we take as compromised?

#23

Post by hackcasual »

tptacek wrote: post #21

"SSH2-RSA" isn't an encryption algorithm. It's a description of the SSH protocol using RSA authentication. It is easier to provide the list of things that are worth worrying about than it is to list the things that are safe. There are a lot of as-yet unbroken ciphers and constructions. So, here are the things to avoid: * Block ciphers in the default mode ("ECB"). * The Dual_EC random number generator, which virtually…

For the record DH key sizes are smaller than RSA keys of the same strength based on our current understanding of the computational effort involved in attacking them. DH-256 should be considered on the verge of too small. 340 or 512 will be necessary going forward.

Re: Ask HN: What encryption algorithms should we take as compromised?

#24

Post by parfe »

tptacek wrote: post #21

"SSH2-RSA" isn't an encryption algorithm. It's a description of the SSH protocol using RSA authentication. It is easier to provide the list of things that are worth worrying about than it is to list the things that are safe. There are a lot of as-yet unbroken ciphers and constructions. So, here are the things to avoid: * Block ciphers in the default mode ("ECB"). * The Dual_EC random number generator, which virtually…

>* Block ciphers in the default mode ("ECB").

You can plainly see the problem ECB causes in this example image: http://legacy.kingston.com/secure/image_files/Figure2_ECB.jp...

Re: Ask HN: What encryption algorithms should we take as compromised?

#25

Post by tptacek »

parfe wrote: post #24
tptacek wrote: post #21

"SSH2-RSA" isn't an encryption algorithm. It's a description of the SSH protocol using RSA authentication. It is easier to provide the list of things that are worth worrying about than it is to list the things that are safe. There are a lot of as-yet unbroken ciphers and constructions. So, here are the things to avoid: * Block ciphers in the default mode ("ECB"). * The Dual_EC random number generator, which virtually…

>* Block ciphers in the default mode ("ECB"). You can plainly see the problem ECB causes in this example image: http://legacy.kingston.com/secure/image_files/Figure2_ECB.jp...

This is a perennial favorite illustration of "what's wrong with the default mode", but it's biggest problem is that given chosen plaintext, you can often decrypt it a byte-at-a-time.

Re: Ask HN: What encryption algorithms should we take as compromised?

#26

Post by drakaal »

All.

All encryption is breakable. You aren't choosing an unpickable lock, you are picking how good of a thief it will take to rob you.

A 4096 bit encryption might make it really expensive to attack you, but those old numbers about "it would take a computer 40,000 years to crack" don't matter much in a world where that just means you spin up 160k instances in the cloud for 3 months.

That's a Dollar amount that makes cracking YOUR bank account not worth doing. But if it were the Nuclear launch codes for Russia's arsenal it would not be undoable.

Re: Ask HN: What encryption algorithms should we take as compromised?

#27

Post by tptacek »

hackcasual wrote: post #23
tptacek wrote: post #21

"SSH2-RSA" isn't an encryption algorithm. It's a description of the SSH protocol using RSA authentication. It is easier to provide the list of things that are worth worrying about than it is to list the things that are safe. There are a lot of as-yet unbroken ciphers and constructions. So, here are the things to avoid: * Block ciphers in the default mode ("ECB"). * The Dual_EC random number generator, which virtually…

For the record DH key sizes are smaller than RSA keys of the same strength based on our current understanding of the computational effort involved in attacking them. DH-256 should be considered on the verge of too small. 340 or 512 will be necessary going forward.

I think I'm probably confusing terms here; you're referring to the size of "a", and I'm referring to the size of "p".

Perhaps 'pbsd will be around in a bit to resolve whether the index calculus will push the size of p or a first; my understanding is that it's bounded by the size of the modulus, and that most of the work it does is independent of the specific element of the group you're attacking.

I am definitely a lot fuzzier on DH key sizes than on RSA; we're getting into cryptanalytic attacks that don't have a lot of relevance to the kind of work I do.

Re: Ask HN: What encryption algorithms should we take as compromised?

#28

Post by tptacek »

pja wrote: post #2

No ssh2-rsa is not known to be broken, although it's suspected that the NSA can factor some small ( It's believed that any elliptic curve algorithm that doesn't have a transparent process for choosing the curve points may have been backdoored by the NSA choosing points that they already knew how to factor. If you use those curves, then you're revealing your secrets to the NSA but not to anyone else, because the discr…

The word "may" is doing a lot of work in the sentence "may have been backdoored". What cryptographers are observing about the NIST P- curves is that it isn't impossible for them to have been backdoored; that there is a plausible technique that NSA could have used, given some an advance in ECC cryptanalysis unknown to public science but known to them, that could result in a backdoor.

Everything beyond that is the precautionary principle.

It's also really important to understand the difference between Dual_EC (the random number generator) and the NIST curves. There is much more circumstantial evidence against Dual_EC. Importantly, the potential backdoor in Dual_EC isn't really related to elliptic curves; you can describe a functionally similar backdoored RNG using other public key algorithms.

Re: Ask HN: What encryption algorithms should we take as compromised?

#29

Post by logicalmind »

p4bl0 wrote: post #5

This question only makes sense if you give the threat-model to consider. Is it only classical cryptanalysis on the cryptographic algorithm? Or do you take into account the programming mistakes (not necessarily related to crypto) of specific implementations? Or do you allow side-channel or fault-injection attacks, which will be able to break most algorithms, if they are not implemented with specific countermeasures? I…

Exactly. A lot is lost when security deals strictly with theory instead of pragmatism. Theoretical breaks in crypto algorithms are important, but much weaker links in the chain are easier to attack. Using the best, unbreakable crypto does not protect you from more realistic attacks.

Obligatory XKCD:

http://xkcd.com/538/

Re: Ask HN: What encryption algorithms should we take as compromised?

#30

Post by tptacek »

sillysaurus3 wrote: post #10

If you're wondering what isn't compromised, the information here has withstood the test of time and scrutiny from the crypto community: http://www.daemonology.net/blog/2009-06-11-cryptographic-rig... Barring some major advance in breaking crypto (which is entirely possible) it will probably stand for a long time to come.

That is the charitable way to describe Colin's suggestions. Another way to describe them is "well-aged", or "conservative".

Here are more modern alternatives to each of Colin's suggestions:

* Message encryption: AES-CTR+HMAC -> A fast native stream cipher (Salsa20) + polynomial MAC (Poly1305, VMAC).

* Standalone integrity checking: HMAC -> HMAC or SHA3.

* Hash: BLAKE2 or SHA3.

* Passwords: scrypt or, if not available, bcrypt.

* Public key encryption: ECDH + whatever you're using for message encryption, over Curve25519.

* Public key signatures: Deterministic ECDSA, EdDSA.

* Ephemeral key agreement: ECDH over Curve25519.

* Online backups: use Tarsnap.

Post reply on HN