Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Seriously, Stop Using RSA (2019)

blog.trailofbits.com

Post reply on HN
Print view View original

11–20 of 125 posts

Re: Seriously, Stop Using RSA (2019)

#11

Post by JCBird1012 »

gleenn wrote: post #10

Is there any new concern that Curve25519 has been backdoored by the NSA? It looks like P-256 did a long time ago, and reading the Wikipedia article doesn't give that impression, wanted to check though.

A backdoor in Curve25519 hasn’t really been a concern, because unlike P-256, the parameters for the curve didn’t come from NIST. Curve25519 is a djb (https://en.wikipedia.org/wiki/Daniel_J._Bernstein) special.

So unless djb was secretly working with the NSA and willing to risk his reputation to backdoor a highly scrutinized elliptic curve, the risk is low.

Re: Seriously, Stop Using RSA (2019)

#12

Post by spicybright »

frostburg wrote: post #5

This is all true, but reads funny to me because I've implemented an intentionally vulnerable version of RSA and still had issues getting timing attacks to work on modern hardware (due to lack of sophistication in my approach, I think).

That actually sounds like a very enlightening exercise! How did you go about doing this? Did you just follow an RSA spec from somewhere?

Re: Seriously, Stop Using RSA (2019)

#14

Post by prophesi »

pvg wrote: post #8
prophesi wrote: post #6

Earlier quoted context omitted.

Two of the images in the article is https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/20... And https://i0.wp.com/blog.trailofbits.com/wp-content/uploads/20... So it sounds like the main pain-point is improper implementation. Though the padding oracle attack is convincing to use something else, as it's necessary to pad yet still opens up to a different attack vector.

The article mentions various RSA implementations that have had problems. The other thing is, since they do audits and are telling you to avoid RSA, the advice obviously isn't 'a properly audited RSA is fine'. "it's actually ok to use RSA" is not a reasonable conclusion to draw from this piece.

I think the crux of the argument is summed up here:

> Developers could theoretically build an ECC implementation with terrible parameters and fail to check for things like invalid curve points, but they tend to not do this.

So, it's just about trusting developers to implement a different algorithm properly.

Re: Seriously, Stop Using RSA (2019)

#15

Post by spicybright »

EarlKing wrote: post #7

Quoted post unavailable.

Unless you're really good at auditing code, why wouldn't you want to use something stronger?

Memory managed languages are generally preferred for a lot of software because it's much harder to introduce memory leaks accidentally vs in something like C.

Yes, C is fine, but if your goal is no memory leaks, you could be doing a lot better.

I don't get why anyone would die on this hill over something as important as encryption. It's like using skeleton keys for your house door, because why would you be careless enough to not know when an intruder walks in?

Re: Seriously, Stop Using RSA (2019)

#17

Post by YATA0 »

spicybright wrote: post #16
YATA0 wrote: post #13

Quoted post unavailable.

Not sure what the joke is here.

There is no joke? Stop implementing your own crypto. Vault has transit encryption out of the box, among other things.

"The transit secrets engine handles cryptographic functions on data in-transit. Vault doesn't store the data sent to the secrets engine. It can also be viewed as "cryptography as a service" or "encryption as a service". The transit secrets engine can also sign and verify data; generate hashes and HMACs of data; and act as a source of random bytes."[0]

[0] https://www.vaultproject.io/docs/secrets/transit

Re: Seriously, Stop Using RSA (2019)

#20

Post by sivizius »

RSA is bad, because developers do not implement it as specified and ECC is good, because most developers will not implement it themself, because they do not understand ECC and therefor use libraries? IMHO a huge advantage of RSA over ECC is it is easy to explain. After you have explained the different kinds of elliptic curves and their pitfalls, you have to explain the integrated encryption scheme to actually use it for encryption. But ok, you want hybrid encryption with RSA too, but in theory, you do not have to.
Post reply on HN