Seriously, Stop Using RSA (2019)
blog.trailofbits.com
Seriously, Stop Using RSA (2019)
1–10 of 125 posts
Re: Seriously, Stop Using RSA (2019)
#2“RSA is bad because developers often don’t implement it correctly, leading to vulnerabilities. Instead, use ECC, which can also be implemented incorrectly, but developers tend to do this less.”
The article raises some good points, but it really explains why you shouldn’t use your own RSA or an unaudited third-party library. A good RSA implementation which has been audited by security experts and doesn’t take shortcuts for performance would alleviate the OP’s concerns.
Re: Seriously, Stop Using RSA (2019)
#3“RSA is bad because developers often don’t implement it correctly, leading to vulnerabilities. Instead, use ECC, which can also be implemented incorrectly, but developers tend to do this less.” The article raises some good points, but it really explains why you shouldn’t use your own RSA or an unaudited third-party library. A good RSA implementation which has been audited by security experts and doesn’t take shortcut…
What is important is more a library where the easiest thing to do is correct, and making it really hard to make mistakes. Make the encrypt/decrypt function the only public api, with as few args as possible. Manage IVs under the hood so the user can't accidentally reuse them.
That's the approach taken by NaCl, and arguably the only one worth considering.
Re: Seriously, Stop Using RSA (2019)
#4“RSA is bad because developers often don’t implement it correctly, leading to vulnerabilities. Instead, use ECC, which can also be implemented incorrectly, but developers tend to do this less.” The article raises some good points, but it really explains why you shouldn’t use your own RSA or an unaudited third-party library. A good RSA implementation which has been audited by security experts and doesn’t take shortcut…
The article doesn't say what your paraphrase says, though, and even less of what your next sentence says. The various RSA implementations with serious problems it brings up weren't all 'own RSA or unaudited third party library'.
Re: Seriously, Stop Using RSA (2019)
#5This is all true, but reads funny to me because I've implemented an intentionally vulnerable version of RSA and still had issues getting timing attacks to work on modern hardware (due to lack of sophistication in my approach, I think).
Re: Seriously, Stop Using RSA (2019)
#6“RSA is bad because developers often don’t implement it correctly, leading to vulnerabilities. Instead, use ECC, which can also be implemented incorrectly, but developers tend to do this less.” The article raises some good points, but it really explains why you shouldn’t use your own RSA or an unaudited third-party library. A good RSA implementation which has been audited by security experts and doesn’t take shortcut…
The article doesn't say what your paraphrase says, though, and even less of what your next sentence says. The various RSA implementations with serious problems it brings up weren't all 'own RSA or unaudited third party library'.
Two of the images in the article is
https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/20...
And
https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/20...
So it sounds like the main pain-point is improper implementation. Though the padding oracle attack is convincing to use something else, as it's necessary to pad yet still opens up to a different attack vector.
Re: Seriously, Stop Using RSA (2019)
#7No post body was provided.
Re: Seriously, Stop Using RSA (2019)
#8Earlier quoted context omitted.
The article doesn't say what your paraphrase says, though, and even less of what your next sentence says. The various RSA implementations with serious problems it brings up weren't all 'own RSA or unaudited third party library'.
Two of the images in the article is https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/20... And https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/20... So it sounds like the main pain-point is improper implementation. Though the padding oracle attack is convincing to use something else, as it's necessary to pad yet still opens up to a different attack vector.
The article mentions various RSA implementations that have had problems. The other thing is, since they do audits and are telling you to avoid RSA, the advice obviously isn't 'a properly audited RSA is fine'. "it's actually ok to use RSA" is not a reasonable conclusion to draw from this piece.
Re: Seriously, Stop Using RSA (2019)
#9Here is a nice discussion of what happens when you don't validate your elliptic curve parameters properly:
* https://research.nccgroup.com/2021/11/18/an-illustrated-guid...
The highlight here is that in some cases, failure to properly validate gets an attacker the secret key material.
Note all the conditional bits. Different curves have different properties and different issues. There are a bunch of different curves in common use while RSA pretty much always uses the same value for the parameter these days (RSA literally has just one parameter. The exponent.).
Re: Seriously, Stop Using RSA (2019)
#10Is there any new concern that Curve25519 has been backdoored by the NSA? It looks like P-256 did a long time ago, and reading the Wikipedia article doesn't give that impression, wanted to check though.