Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail now offers elliptic curve cryptography

protonmail.com

Post reply on HN
Print view View original

141–148 of 148 posts

Re: ProtonMail now offers elliptic curve cryptography

#141

Post by fghtr »

JudgeWapner wrote: post #101
KirinDave wrote: post #79

Earlier quoted context omitted.

I use Gmail for most things, because in terms of account security it's probably the best in the world. I do not use email for discussing sensitive topics. It is not the right tool for the job.

Does anyone use gmail + PGP ? if the two parties understand how to send encrypted messages over web clients, isn't that still secure ? I haven't heard much about PGP for the past 5+ years. I realize PGP itself isn't a protocol, but there used to be a system where you'd publish your public key (irrespective of what protocol (RSA, ECDSA, etc) you use) somewhere and anyone could send you encrypted messages and paste the…

> if the two parties understand how to send encrypted messages over web clients, isn't that still secure ?

It is secure, except that metadata are open go Google. And metadata is the new data nowadays.

Re: ProtonMail now offers elliptic curve cryptography

#142

Post by protonmail »

qqn wrote: post #100
glaurung_ wrote: post #64

Earlier quoted context omitted.

Out of curiosity, what did you switch to? I'd like to leave Gmail and Proton Mail seems to be pretty well recommended. Is Fast Mail a better option?

I've been using Tutanota for almost a year now and it's pretty good. I'm no expert on encryption but that part also seems pretty solid [0,1]. NordVPN "leans towards" TN over PM, but only for convenience and not security (that's more or less equal between the two)[2]. However, PM is based in Switzerland (not bound by GDPR), while TN is in Germany (bound by GDPR and other privacy laws that the EU is really progressive…

ProtonMail actually has a dedicated export tool: https://protonmail.com/support/knowledge-base/export-import-...

ProtonMail also encrypts emails, contacts, contents, attachments, of all emails you send and receive, with end-to-end encryption.

However, the most important differentiator is the trust model. ProtonMail has Address Verification, which means it is trust on first use, which is significantly more secure than the trust on every use model Tutanota uses for key distribution. Details here: https://www.reddit.com/r/ProtonMail/comments/b84kd3/why_is_p...

Re: ProtonMail now offers elliptic curve cryptography

#143

Post by protonmail »

deagle50 wrote: post #51
KirinDave wrote: post #48

Earlier quoted context omitted.

I don't know OSX very well these days. Is that... is that actually installing a new global SSL trust root? Doesn't that mean ProtonMail now can seamlessly MitM all SSL connections on that machine? Please tell me I'm reading that wrong, because I don't recall doing this for ProtonVPN on linux.

In the instructions they ask the user to "always trust" the cert for all use cases, including SSL. If you do that, any app that uses OS certs can be MITMed. It should be enough to trust the cert for IPSec only.

Indeed, it is enough to trust the cert just for IPSec, and we have updated the article to reflect that. We also have native applications on macOS so the manual IKEv2 setup is not the recommend method of usage of ProtonVPN.

Re: ProtonMail now offers elliptic curve cryptography

#144

Post by jgowdy »

I quit ProtonMail / ProtonVPN after trying over and over and over again to import mail through their IMAP bridge. They won't provide an open API for interacting with their mail services so someone can write a better bridge, and their bridge is very slow, disconnects repeatedly, and basically makes any migrations impossible. If you're willing to start over with an empty mailbox, maybe ProtonMail is for you. I eventually gave up trying to move my mail account in (many tries, with Thunderbird in chunks, with Lamiral's awesome imapsync tool, you name it), and let them keep the money I paid for a year of ProtonMail Visionary.

I ended up using StartMail from the StartPage people. It's not perfect, but I was actually able to migrate to it and use it effectively.

Re: ProtonMail now offers elliptic curve cryptography

#145

Post by _eht »

wtmt wrote: post #134
_eht wrote: post #73

Earlier quoted context omitted.

Fastmail is a great service, the caveat is that they are based in Australia. Take that for what it's worth.

Fastmail the company is based in Australia, while Fastmail's servers are located in the US. Take that for what it's worth, considering Five Eyes!

That’s a double whammy IMO

Re: ProtonMail now offers elliptic curve cryptography

#146

Post by a1369209993 »

tptacek wrote: post #124
a1369209993 wrote: post #107

Earlier quoted context omitted.

Actually, Ed25519 is the Edwards curve isomorphic to Curve25519 (which IIRC is a Montgomery curve). Edwards is faster than Montgomery for signature, but not significantly slower for key agreement. You can use it for ECDH, and unless I've missed some non-obvious attack (which is of course, entirely possible) you probably should, since that allows you to use (mostly) the same elliptic curve math primitives for key agre…

My understanding is that Ed25519 is birational to Curve25519, not actually isomorphic, but also that the difference between the two ("almost" vs "perfectly" isomorphic) is not really all that interesting. I thought Ed25519 was better for multiple-base operations used in signing, but slower for variable-base operations in ECDH.

> that Ed25519 is birational to Curve25519, not actually isomorphic

That might be the case, I only meant isomorphic in the programming sense of f(x) = h⁻¹(g(h(x))) for relatively trivial h.

> I thought Ed25519 was [...] slower for variable-base operations in ECDH.

My understanding is that Ed25519 requires replacing several of Curve25519's field squarings with general multiplications, but isn't actually any slower if you use a general multiply for everything. I'm not sure how much optimization you can get out of squaring though, so it might be a easy 10% bonus you're passing up there.

Re: ProtonMail now offers elliptic curve cryptography

#147

Post by arghwhat »

tptacek wrote: post #125
arghwhat wrote: post #102

Earlier quoted context omitted.

I'm sorry, I misworded myself: There is general distrust in NIST, not any known issues with those curves. However, it is general consensus to prefer Ed25519 over NIST curves, specifically preferring it over P-256. The benefits of its implementation are a cherry on top. I have yet to see any suggestion or reason to pick P-256 when Ed25519 is available. And yes, Ed25519 is the defacto standard. Hell, I don't even recal…

The article itself talks about X25519, which is Curve25519, not Ed25519. Ed25519 is not in fact the de facto standard for signing on curves; that's clearly P-256 ECDSA. You're saying that Ed25519 is better , and I agree, but P-256 is much more prevalent. Again, people don't use Ed25519 because they distrust NIST (although many people do distrust NIST). They use it because: 1. It's easier to implement in constant time…

> The article itself talks about X25519

Seems like they made a mistake. They're referring to your private key (which is used for signing) as "X25519", but X25519 is meant for key exchanges.

Nothing but Ed25519 makes sense in this particular context, unless they've gone out of their way to do something very non-standard.

> Ed25519 is not in fact the de facto standard for signing on curves; that's clearly P-256 ECDSA.

Having never been confronted with anyone having chosen P-256 ECDSA, I question the validity of this statement.

It is important to remember that this also requires use. I have a few times stumbled upon things where only NIST curves where supported, but in those cases, RSA remained the choice of the users.

> Again, people don't use Ed25519 because they distrust NIST (although many people do distrust NIST).

None of these arguments make sense to those not implementing the cryptographic libraries on their own (which, while fun, is not recommended).

For the integrator and the user, it's simply a case of reading the docs and picking.

Re: ProtonMail now offers elliptic curve cryptography

#148

Post by deagle50 »

protonmail wrote: post #143
deagle50 wrote: post #51

Earlier quoted context omitted.

In the instructions they ask the user to "always trust" the cert for all use cases, including SSL. If you do that, any app that uses OS certs can be MITMed. It should be enough to trust the cert for IPSec only.

Indeed, it is enough to trust the cert just for IPSec, and we have updated the article to reflect that. We also have native applications on macOS so the manual IKEv2 setup is not the recommend method of usage of ProtonVPN.

Cheers!
Post reply on HN