Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RSA warns developers not to use RSA products

blog.cryptographyengineering.com

Post reply on HN
Print view View original

51–60 of 81 posts

Re: RSA warns developers not to use RSA products

#51

Post by jpgoldberg »

tlb wrote: post #20
anaphor wrote: post #3

Earlier quoted context omitted.

Especially the part about KDFs being deliberately slow, and according to him that somehow implies that RNGs should also be slow. Whut? This guy is really a CTO?

"The length of time that Dual_EC_DRBG takes can be seen as a virtue: it also slows down an attacker trying to guess the seed." If a system's seed is weak, one attack is to try all likely seeds, run them through the PRNG to generate keys, and see if any of the keys work. A slow PRNG indeed slows down this process. For instance, it would have slowed down the attack on the Taiwan Cryptocards, which exploited patterns in…

I've been a big advocate of things like PBKDF2 and such to slow things down where appropriate. But except for very specialized circumstances (and an RNG isn't one of them), we want cryptographic operations to be fast. In general, we want RNGs (and most things) to be fast and efficient.

And in particular, TW Cryptocards analysis never had to run the RNG. Just had to look at 2 million public keys already out there.

Re: RSA warns developers not to use RSA products

#52

Post by tptacek »

ballard wrote: post #30
[deleted] wrote: post #15

[deleted]

Then feel free to question Schneier's chops: http://www.wired.com/politics/security/commentary/securityma... Edit: this was in response to the deleted comment

I'll take you up on that.

Here's Schneier on ECC:

https://www.schneier.com/crypto-gram-9911.html#EllipticCurve...

He wrote this in 1999; ECC was at the time sort of a novelty, it's headline being "a way to do cryptography with smaller key sizes", as if ECC was mostly a way to fit crypto into smaller memory software.

Schneier and Ferguson wrote _Practical Cryptography_ in 2003. It has virtually no mention whatsoever of ECC cryptography, despite ECC's already significantly increased importance by then.

In 2013, I think it's fair to say that the balance of expert opinion on ECC vs. RSA is sharply against Schneier's take on ECC. RSA is on the way out, and ECC is what's going to replace it. Equally significantly, crypto constructions that use signing and key agreement but not public-key encryption/decryption operations are modern designs; designs where a long-lived RSA key is used to wrap and unwrap secrets are dated. ECC is useful for the modern constructions and less so for the dated ones.

I don't think Schneier's writing has tracked these shifts well. I think his books are very light on, for instance, forward secrecy or deterministic signing. His research results never focused on public key encryption and never touched ECC (it's worth noting that much of his best known research was also done with John Kelsey, who is at NIST --- coincidentally, one of Schneier's best-known designs, with Kelsey, was the Yarrow CSPRNG).

Also: Schneier has a close working relationship with Niels Ferguson, who was one of the researchers that spotted the weirdness in Dual_EC. So it's possible that Schneier's concerns over the "constants" in ECC all stem from that. (It's hard to say; he could also be referring to the random seed in the P-224 and P-256 curves).

I don't think readers have any particular reason to believe that Bruce Schneier is an authority on ECC.

Cryptography is not one topic. It's actually a little silly to suggest anyone like Schneier could be authoritative on all crypto concepts. Look at the research output of famous cryptographic researchers (Schneier has some research, but is not really a top-tier researcher) --- it tends to specialize!

Re: RSA warns developers not to use RSA products

#53

Post by icelancer »

tptacek wrote: post #43
icelancer wrote: post #13

Earlier quoted context omitted.

I don't understand his constant line in the sand on this issue (amongst other things). You basically illustrated exactly how he structures his arguments on this topic.

If I was smart enough to understand what this comment meant, I'd respond to it. Maybe you could clarify? I can't find a way to reconcile it with its parent comment in a way that gives me anything to discuss.

You seem to have already addressed it in another comment:

>Thanks for the link. I would have just gone on confirming my own biases without it.

This is incredibly evident in your comments on Dual_EC and sometimes happens on other comments as well. You draw a line in the sand and argue around it constantly, eventually bleeding into passive-aggressive attacks on the knowledge of others.

I find it valuable to hear from others outside of my industry (which is not crypto) who have no expertise in that field. They often have a fresh and agnostic look at something. Do you think all these comments slinging mud at you - however inaccurate they may be - were born from nothing?

Re: RSA warns developers not to use RSA products

#54

Post by tptacek »

icelancer wrote: post #53
tptacek wrote: post #43

Earlier quoted context omitted.

If I was smart enough to understand what this comment meant, I'd respond to it. Maybe you could clarify? I can't find a way to reconcile it with its parent comment in a way that gives me anything to discuss.

You seem to have already addressed it in another comment: >Thanks for the link. I would have just gone on confirming my own biases without it. This is incredibly evident in your comments on Dual_EC and sometimes happens on other comments as well. You draw a line in the sand and argue around it constantly, eventually bleeding into passive-aggressive attacks on the knowledge of others. I find it valuable to hear from o…

How about this: why don't you tell me what you think my "line in the sand" is? I bet I don't have that line at all.

I have a different explanation for why I always seem to be at odds with people on NSA topics, but I'll wait to provide it.

Re: RSA warns developers not to use RSA products

#55

Post by mcphilip »

[deleted] wrote: post #33
lawnchair_larry wrote: post #4

Hasn't tptacek posted "nothing to see here" regarding this issue on HN a half dozen times because "nobody uses it"? :)

[deleted]

An interesting data point from the boilerplate about the RSA in a press release [1]:

"With approximately a billion RSA BSAFE-enabled applications in use worldwide, more than nine million RSA SecurID authentication users and almost 20 years of industry experience, RSA Security has the proven leadership and innovative technology to address the changing security needs of e-business and bring trust to the new, online economy."

I know this submission has been flagged off the front page, but I'm curious on your opinion if this number is misleading.

[1]http://www.tgc.com/dsstar/01/0724/103320.html

Re: RSA warns developers not to use RSA products

#56

Post by tptacek »

mcphilip wrote: post #55
[deleted] wrote: post #33

Earlier quoted context omitted.

[deleted]

An interesting data point from the boilerplate about the RSA in a press release [1]: "With approximately a billion RSA BSAFE-enabled applications in use worldwide, more than nine million RSA SecurID authentication users and almost 20 years of industry experience, RSA Security has the proven leadership and innovative technology to address the changing security needs of e-business and bring trust to the new, online eco…

Let me just say that when my brain tries to survey the landscape for products that use crypto, it mentally discounts all the SecurID tokens; it doesn't occur to me to think about the RSA in-house products that use BSAFE. So yes, there's another group of deployed products that use commercial crypto libraries, because they're sold by a company that also owns a commercial crypto library.

My reasoning about this mostly comes from the fact that products usually don't use commercial crypto libraries.

Re: RSA warns developers not to use RSA products

#58

Post by icelancer »

tptacek wrote: post #54
icelancer wrote: post #53

Earlier quoted context omitted.

You seem to have already addressed it in another comment: >Thanks for the link. I would have just gone on confirming my own biases without it. This is incredibly evident in your comments on Dual_EC and sometimes happens on other comments as well. You draw a line in the sand and argue around it constantly, eventually bleeding into passive-aggressive attacks on the knowledge of others. I find it valuable to hear from o…

How about this: why don't you tell me what you think my "line in the sand" is? I bet I don't have that line at all. I have a different explanation for why I always seem to be at odds with people on NSA topics, but I'll wait to provide it.

>eventually bleeding into passive-aggressive attacks on the knowledge of others.

Thanks for proving my point.

Re: RSA warns developers not to use RSA products

#59

Post by ballard »

tptacek wrote: post #52
ballard wrote: post #30

Earlier quoted context omitted.

Then feel free to question Schneier's chops: http://www.wired.com/politics/security/commentary/securityma... Edit: this was in response to the deleted comment

I'll take you up on that. Here's Schneier on ECC: https://www.schneier.com/crypto-gram-9911.html#EllipticCurve... He wrote this in 1999; ECC was at the time sort of a novelty, it's headline being "a way to do cryptography with smaller key sizes", as if ECC was mostly a way to fit crypto into smaller memory software. Schneier and Ferguson wrote _Practical Cryptography_ in 2003. It has virtually no mention whatsoever o…

You're missing context because it was deleted by the comment's author. It was claimed that Linus Torvalds was "the authority" and that articles were written by non-technical reporters. Schneier is clearly not a non-technical reporter.

No claim was made by anyone that Schneier was the one-and-only security god either. Some people worship the ground person P walks on, but it's still just ground. Celebrity doesnt make 2+2 = 5, only for very large values of 2. I do think there is a common antipattern of wanting to rely upon one technology or one authority as a "security oracle," but this goes against holistic, defense-in-depth.

The other points are fine, just non-apropos.

But since you went there: Does the less elucidatbility (yep that's not a word, but a self-referencing pun) of ECC for the average joe programmer like myself make it any more secure than picking longer RSA keys? ECC seems so much easier to screw up in subtle ways that only leet mathematicians can grasp. Also, the change seems like change for churn's sake to sell more consulting. I used to work with big 4 folks, and there's always a joke a about the latest fad that needs selling, so I'm biased against popular, unjustified change.

Re: RSA warns developers not to use RSA products

#60

Post by Spearchucker »

tptacek wrote: post #44
rexreed wrote: post #29

Earlier quoted context omitted.

You mean like here [1] and here [2] and here [3]? [1] http://www.pcworld.idg.com.au/article/129305/rsa_security_so... [2] http://satchitssecurity.typepad.com/a_page_from_satchits_sec... [3] http://www.tgc.com/dsstar/01/0724/103320.html

I'm surprised by this. We look at a lot of stuff. OpenSSL is far and away the most common crypto library we see. Commercial crypto libraries are way, way down the list, after "reimplemented all of elliptic curve by hand". Thanks for the link. I would have just gone on confirming my own biases without it.

That, I think, is indicative of this community. I come across it a lot, and there are some insanely high profile, non-US organizations that rely on it. SAP being an example that I'm ok with mentioning.
Post reply on HN