Seriously, Stop Using RSA (2019) • Hacker News Board

Re: Seriously, Stop Using RSA (2019)

#71

Post by nullc » Sat, Apr 02, 2022, 1:33 AM UTC

thaumasiotes wrote: post #67

nullc wrote: post #61

Earlier quoted context omitted.

key[31]=(key[31]&63)|64;key[0]&=248; is radically simpler and not remotely comparable to the requirements for RSA key generation. Moreover, RSA key generation is massively slow-- enough to be irritating for users even on fast computers so there is a lot of incentive to 'optimize' key generation and introduce complexity that results in bugs. (do not use, I just implemented what the GP poster said, didn't check if it w…

> (key[31]&63)|64 You confused me here; this looks like you're clearing the highest bit and then setting the highest bit... in a 7-bit integer. Of course it makes more sense that you're clearing the two highest bits and then setting the second-highest bit of an 8-bit integer, which is indeed the same thing as clearing the highest bit and then setting the second-highest bit. But why have you written it to fiddle the s…

just because 63 was a shorter constant to type than 127. Hex would have been longer due to the prefix. :P

Re: Seriously, Stop Using RSA (2019)

#72

Post by woodruffw » Sat, Apr 02, 2022, 1:35 AM UTC

gleenn wrote: post #10

Is there any new concern that Curve25519 has been backdoored by the NSA? It looks like P-256 did a long time ago, and reading the Wikipedia article doesn't give that impression, wanted to check though.

There's no particular evidence that the NSA has backdoored P-256 or any other cipher in Suite B. Suite B is considered suitable for protecting compartmentalized classified information, so it would be actively dangerous for the NSA to attempt to backdoor it.

The closest thing to evidence of a backdoor is circumstantial: P-256 and the others use seeds that have never been fully explained. But this alone isn't particularly unusual: DES's S-boxes were similarly chosen opaquely, and we now know that the NSA did this to strengthen DES against the not-yet-public technique of differential cryptanalysis.

All that being said, Curve25519 (and Ed25519) is just better, and you should prefer it whenever you can[1].

[1]: https://safecurves.cr.yp.to/

Re: Seriously, Stop Using RSA (2019)

#73

Post by cantrevealname » Sat, Apr 02, 2022, 2:10 AM UTC

There's an extremely interesting rebuttal that appears as a comment in the original article. I'm going to quote it below for the benefit of HN readers.

/QUOTE

Bob, February 28, 2020 at 12:15

KEEP USING RSA!

This article is misleading to make it appear that RSA is not secure, but only the only evidence presented is improper implementation.

Properly implemented RSA has been proven secure and unbreakable by the NSA with case studies such as Snowden, Lavabit, dark markets, and ECC is much harder to properly implement than RSA.

The NSA has been pushing ECC because their quantum chips can break it easily. D-Wave, Google, Alibaba, and others already have quantum chips. The disinformation agents claim that “quantum computers don’t exist” which is true because nobody uses a computer to break crypto, they use specialized custom chips.

All ECC (X25519-P521) will be broken by private sector quantum chips before RSA-2048 due to the physical limitations of stabilizing qubits.

The people making false claims against RSA are either being paid or they are useful idiots.

/END-QUOTE

Re: Seriously, Stop Using RSA (2019)

#74

Post by duskwuff » Sat, Apr 02, 2022, 2:13 AM UTC

tialaramex wrote: post #70

duskwuff wrote: post #65

Earlier quoted context omitted.

Explaining all of the ways an RSA key can be weak, and what you have to do to avoid generating one, would take a lot longer.

This is not really fair. The correct way to mint RSA keys is actually pretty simple, a naive approach works fine - it's just that doing this is slow and when people try to do something fast they keep making keys which fail the criteria you listed. The tests you've advocated make sense if somebody else picked the keys and you're worried whether they did a good job, some of these tests are mandatory for a Web PKI Certi…

> The odds of "accidentally" getting two factors that are unduly close...

... are actually pretty high with some poorly conceived key generation algorithms.

There are other ways that RSA key generation can be weak, such as ROCA (https://en.wikipedia.org/wiki/ROCA_vulnerability).

Re: Seriously, Stop Using RSA (2019)

#75

Post by 3np » Sat, Apr 02, 2022, 2:23 AM UTC

jchook wrote: post #34

Sounds like the author would agree it's fine to use RSA, so long as you use an audited library with a well-designed API that makes it easy to do the right thing, and hard to do the wrong thing. This makes me wonder, if we have an RSA library as good as libsodium, is ECC really a better choice than RSA? I love libsodium and tend to choose it, but ECC seems far more mysterious to me than RSA. Curve25519 is much newer,…

ECDSA is a lot computationally cheaper for the same strength. Switching from RSA to ECDSA TLS certs can have a significant impact on the CPU usage for, say a reverse proxy. (By extension, costs less in terms of money and environmental impact).

That being said, I do think that global monoculture and putting all eggs in one basket as a society is a bad idea. If you're willing to take the cost and prefer to use something you understand - by all means do so, as long as you're aware of the tradeoffs you're making.

Re: Seriously, Stop Using RSA (2019)

#76

Post by willis936 » Sat, Apr 02, 2022, 2:28 AM UTC

cantrevealname wrote: post #73

There's an extremely interesting rebuttal that appears as a comment in the original article. I'm going to quote it below for the benefit of HN readers. /QUOTE Bob, February 28, 2020 at 12:15 KEEP USING RSA! This article is misleading to make it appear that RSA is not secure, but only the only evidence presented is improper implementation. Properly implemented RSA has been proven secure and unbreakable by the NSA with…

Sounds like tinfoil hat. Afaict RSA is simpler to crack with quantum computers than ECC.

Re: Seriously, Stop Using RSA (2019)

#77

Post by motohagiography » Sat, Apr 02, 2022, 2:33 AM UTC

Just to say, understanding the complexity of the topic they are discussing, this is one of the finest pieces of writing I have ever read. If you can express this issue clearly, you can express anything clearly, imo.

Re: Seriously, Stop Using RSA (2019)

#78

Post by deadbeeves » Sat, Apr 02, 2022, 2:34 AM UTC

willis936 wrote: post #76

cantrevealname wrote: post #73

There's an extremely interesting rebuttal that appears as a comment in the original article. I'm going to quote it below for the benefit of HN readers. /QUOTE Bob, February 28, 2020 at 12:15 KEEP USING RSA! This article is misleading to make it appear that RSA is not secure, but only the only evidence presented is improper implementation. Properly implemented RSA has been proven secure and unbreakable by the NSA with…

Sounds like tinfoil hat. Afaict RSA is simpler to crack with quantum computers than ECC.

No, the discrete logarithm problem and the prime factoring problem are very similar and are both solved by Shor's algorithm. I suspect they might actually be equivalent, in a weird way.

Re: Seriously, Stop Using RSA (2019)

#79

Post by throwawaylinux » Sat, Apr 02, 2022, 2:35 AM UTC

cantrevealname wrote: post #73

There's an extremely interesting rebuttal that appears as a comment in the original article. I'm going to quote it below for the benefit of HN readers. /QUOTE Bob, February 28, 2020 at 12:15 KEEP USING RSA! This article is misleading to make it appear that RSA is not secure, but only the only evidence presented is improper implementation. Properly implemented RSA has been proven secure and unbreakable by the NSA with…

This is along the lines of my thinking.

I don't think any of those "case studies" prove anything about whether or not the NSA can break RSA. But if they alone could break ECC and not RSA, they would certainly push for ECC.

Because if they were just worried that other groups could break RSA, then presumably they would be happy to provide a demonstration or show evidence for such attacks.

Re: Seriously, Stop Using RSA (2019)

#80

Post by sudosysgen » Sat, Apr 02, 2022, 2:43 AM UTC

JCBird1012 wrote: post #11

gleenn wrote: post #10

Is there any new concern that Curve25519 has been backdoored by the NSA? It looks like P-256 did a long time ago, and reading the Wikipedia article doesn't give that impression, wanted to check though.

A backdoor in Curve25519 hasn’t really been a concern, because unlike P-256, the parameters for the curve didn’t come from NIST. Curve25519 is a djb ( https://en.wikipedia.org/wiki/Daniel_J._Bernstein ) special. So unless djb was secretly working with the NSA and willing to risk his reputation to backdoor a highly scrutinized elliptic curve, the risk is low.

The issue is that RSA isn't backdorable, while elliptic curves are. Even if we trust the author, it's better not to trust anyone.