Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Seriously, Stop Using RSA (2019)

blog.trailofbits.com

Post reply on HN
Print view View original

91–100 of 125 posts

Re: Seriously, Stop Using RSA (2019)

#91

Post by nullc »

retrocryptid wrote: post #82

meh. dude seems to be conflating "don't use RSA" with "don't roll your own crypto." If we are to believe Scott Vanstone, ECC has security proofs that RSA doesn't. And I found Scott was a pretty trustworthy guy. So the OP has a point. It's probably easier to mess up RSA then ECC. But it's not easy to not mess up ECC, so maybe the title should have been "for the love of god, don't roll your own crypto." Maybe look at N…

Someone still had to write it and those people make mistakes too. Don't roll your own can run dangerously close to abstinence only as a solution for teen pregnancy. Certainly there are cases where "don't reinvent the wheel" is useful advice, but there are a great many where it isn't.

Re: Seriously, Stop Using RSA (2019)

#92

Post by _8j50 »

Isn't RSA the best assymmetric crypto system for when you do need that? I mean, I get it for signatures, key exchange and data encryption it should be avoided but what else is there for symmetric key encryption such as how S/MIME uses it for example. I always thought RSA+OAEP with >= 4096 bits was an acceptable way to encrypt symmetric key material for transport.

I only know of PGP as the alternative which isn't well supported in many environments (especially commercial).

Re: Seriously, Stop Using RSA (2019)

#93

Post by loeg »

_8j50 wrote: post #92

Isn't RSA the best assymmetric crypto system for when you do need that? I mean, I get it for signatures, key exchange and data encryption it should be avoided but what else is there for symmetric key encryption such as how S/MIME uses it for example. I always thought RSA+OAEP with >= 4096 bits was an acceptable way to encrypt symmetric key material for transport. I only know of PGP as the alternative which isn't well…

No. You can encrypt symmetric keys with literally any other asymmetric crypto system, such as ECC, as mentioned in the article.

Re: Seriously, Stop Using RSA (2019)

#94

Post by loeg »

3np wrote: post #90
eek2121 wrote: post #88

Earlier quoted context omitted.

Of course it is a bad idea. See OpenSSL.

Could you elaborate on how you think that is relevant to what I wrote?

GP is almost certainly agreeing with your statement:

> global monoculture and putting all eggs in one basket as a society is a bad idea

Re: Seriously, Stop Using RSA (2019)

#95

Post by 3np »

loeg wrote: post #94
3np wrote: post #90

Earlier quoted context omitted.

Could you elaborate on how you think that is relevant to what I wrote?

GP is almost certainly agreeing with your statement: > global monoculture and putting all eggs in one basket as a society is a bad idea

Ah, you're probably right, ambiguous violent agreement (:

Re: Seriously, Stop Using RSA (2019)

#96

Post by jossclimb »

danenania wrote: post #23

EnvKey[1] moved from OpenPGP (RSA) to NaCl[2] for its v2, which recently launched. It’s causing a difficult migration for our v1 users. Moving to a new encryption scheme is not fun for a product with client-side end-to-end encryption. But within a year or so of releasing the v1, it seemed like the writing was on the wall for OpenPGP and RSA. I didn't want to go down with a dying standard. NaCl is so much better . In…

What was your reason for developing the project in typescript? Looks like an interesting choice for a CLI / key mgmt system.

Re: Seriously, Stop Using RSA (2019)

#98

Post by iofiiiiiiiii »

I have a vague understanding that it is not so easy to encrypt data with ECC as it is with RSA. Is that true? This is one reason I still use RSA. What is the right way to use an ECC public key to encrypt data so only the holder of the private key can decrypt it? (Without any fancy key exchange - just fire and forget, email style)

Re: Seriously, Stop Using RSA (2019)

#99

Post by ccbccccbbcccbb »

cantrevealname wrote: post #73

There's an extremely interesting rebuttal that appears as a comment in the original article. I'm going to quote it below for the benefit of HN readers. /QUOTE Bob, February 28, 2020 at 12:15 KEEP USING RSA! This article is misleading to make it appear that RSA is not secure, but only the only evidence presented is improper implementation. Properly implemented RSA has been proven secure and unbreakable by the NSA with…

The campaign against RSA is pretty evident for my pattern recognizer, for it comes in distinct waves and employs templated articles, which indicate an organized backing behind it; And it has some markers of psychological manipulation - first and foremost, when you honestly have an Y better than X, you don't yell at everyone imperatively to stop using X, instead you plausibly and intelligibly highlight all the advantages of Y and let the readers draw their own conclusions.

Clearly this is not the tactic used in the article in question and many more alike. One just doesn't promote better things by declaring all prior art inferior unfoundedly without any vested interest.

Re: Seriously, Stop Using RSA (2019)

#100

Post by octoberfranklin »

stouset wrote: post #69
jchook wrote: post #34

Sounds like the author would agree it's fine to use RSA, so long as you use an audited library with a well-designed API that makes it easy to do the right thing, and hard to do the wrong thing. This makes me wonder, if we have an RSA library as good as libsodium, is ECC really a better choice than RSA? I love libsodium and tend to choose it, but ECC seems far more mysterious to me than RSA. Curve25519 is much newer,…

> and could potentially have a backdoor (like it's precursor, P-256) P-256 is not known to or even suspected to have any backdoors.

Then I'm sure you can explain where the number c49d3608 86e70493 6a6678e1 139d26b7 819f7e90 came from.

http://safecurves.cr.yp.to/rigid.html

https://credelius.com/credelius/?p=97

With Curve25519, by contrast, DJB explains exactly what constraints were imposed (with very solid justifications for each of them) and then proves that Curve25519 is the unique solution to these constraints which minimizes the remaining free coefficient (which maximizes efficiency). NIST should appoint him to be their Czar or something.

Post reply on HN