Signify: Securing OpenBSD from Us to You • Hacker News Board

Re: Signify: Securing OpenBSD from Us to You

#21

Post by quesera » Sat, Jun 13, 2015, 1:28 AM UTC

nickpsecurity wrote: post #16

Quick comment regarding key sizes. NSA has a patent on ECC, expects licenses for commercial use, and has some kind of conditions you must adhere to if applying for a license. I'll let your imagination wonder on that last part as mine does. The choice is easy for me between asymmetric crypto that's patent-free and a kind the NSA controls. This might not apply to your personal use but it can to any company using such a…

> NSA has a patent on ECC ...

Wow, I was not aware that it was even possible for government agencies to hold patents.

Is there any reasonable justification for that?

Re: Signify: Securing OpenBSD from Us to You

#22

Post by stock_toaster » Sat, Jun 13, 2015, 1:31 AM UTC

quesera wrote: post #21

nickpsecurity wrote: post #16

Quick comment regarding key sizes. NSA has a patent on ECC, expects licenses for commercial use, and has some kind of conditions you must adhere to if applying for a license. I'll let your imagination wonder on that last part as mine does. The choice is easy for me between asymmetric crypto that's patent-free and a kind the NSA controls. This might not apply to your personal use but it can to any company using such a…

> NSA has a patent on ECC ... Wow, I was not aware that it was even possible for government agencies to hold patents. Is there any reasonable justification for that?

Maybe to prevent some private company from patenting it?

It depends on what one does with a patent. I would think making it free for anyone use, if that were indeed the case, would be appropriate though.

Re: Signify: Securing OpenBSD from Us to You

#23

Post by kragen » Sat, Jun 13, 2015, 1:45 AM UTC

quesera wrote: post #21

nickpsecurity wrote: post #16

Quick comment regarding key sizes. NSA has a patent on ECC, expects licenses for commercial use, and has some kind of conditions you must adhere to if applying for a license. I'll let your imagination wonder on that last part as mine does. The choice is easy for me between asymmetric crypto that's patent-free and a kind the NSA controls. This might not apply to your personal use but it can to any company using such a…

> NSA has a patent on ECC ... Wow, I was not aware that it was even possible for government agencies to hold patents. Is there any reasonable justification for that?

Neither the NSA nor anybody else has a patent on ECC. (And no, there is no reasonable justification for government agencies to hold patents, except to make them free to the public.) There are some patents on particular ECC techniques, as explained in http://cr.yp.to/ecdh/patents.html, but they do not cover the currently most popular ECC systems, and in any case they are mostly expired.

Re: Signify: Securing OpenBSD from Us to You

#24

Post by tptacek » Sat, Jun 13, 2015, 1:46 AM UTC

nickpsecurity wrote: post #16

Quick comment regarding key sizes. NSA has a patent on ECC, expects licenses for commercial use, and has some kind of conditions you must adhere to if applying for a license. I'll let your imagination wonder on that last part as mine does. The choice is easy for me between asymmetric crypto that's patent-free and a kind the NSA controls. This might not apply to your personal use but it can to any company using such a…

That would be a neat trick, since the foundational patents for ECC were filed in early 90s. The NSA patents are even earlier.

Re: Signify: Securing OpenBSD from Us to You

#25

Post by [deleted] » Sat, Jun 13, 2015, 1:46 AM UTC

quesera wrote: post #21

nickpsecurity wrote: post #16

Quick comment regarding key sizes. NSA has a patent on ECC, expects licenses for commercial use, and has some kind of conditions you must adhere to if applying for a license. I'll let your imagination wonder on that last part as mine does. The choice is easy for me between asymmetric crypto that's patent-free and a kind the NSA controls. This might not apply to your personal use but it can to any company using such a…

> NSA has a patent on ECC ... Wow, I was not aware that it was even possible for government agencies to hold patents. Is there any reasonable justification for that?

[deleted]

Re: Signify: Securing OpenBSD from Us to You

#26

Post by kragen » Sat, Jun 13, 2015, 1:47 AM UTC

atmosx wrote: post #2

@tedu writes: > There was a PGP usability study conducted a few years ago where a group of technical people were placed in a room with a computer and asked to set up PGP. Two hours later, they were never seen or heard from again. This argument doesn't hold ground. If "technical people" can not setup a new GnuPG key in 20 minutes, they are obviously not "technical" in this context. I'm 100% sure OpenBSD is absolutely…

The paper is full of jokes like this. It’s clear, though, that GPG is much larger than we would like our TCB to be, and that it does have serious usability problems, some of which are inherent to its trust model and therefore cannot be papered over by GPG frontends. (They don't, however, stop you from using it to authenticate upgrades, as Debian and Ubuntu do.)

Re: Signify: Securing OpenBSD from Us to You

#27

Post by kragen » Sat, Jun 13, 2015, 1:49 AM UTC

nickpsecurity wrote: post #14

brynet wrote: post #4

Earlier quoted context omitted.

GnuPG is complicated, the gpg(1) man page is quite extensive compared to signify. I imagine very few people have set up PGP without the help of a search engine. $ man gpg | pr | grep Page | awk '{print $6}' | tail -1 58 $ man signify | pr | grep Page | awk '{print $6}' | tail -1 2

I got back on GnuPG recently because an associate wouldn't communicate without it. We came up with a trustworthy way to exchange keys. After that, I just cut and pasted crap from this: http://irtfweb.ifa.hawaii.edu/~lockhart/gpg/ Been working fine so far. I'm sure there's all kinds of complicated ways to use it but it just takes a few commands to do most of the work. I only use two these days: one for sending and one…

Are you really confident that cutting and pasting crap from a random web page (particularly one without TLS, so the guy sitting across from you at Starbucks can MITM it) provides you with sufficient understanding to notice when you are accidentally doing something insecure?

Re: Signify: Securing OpenBSD from Us to You

#28

Post by nickpsecurity » Sat, Jun 13, 2015, 1:54 AM UTC

sdevlin wrote: post #19

nickpsecurity wrote: post #16

Quick comment regarding key sizes. NSA has a patent on ECC, expects licenses for commercial use, and has some kind of conditions you must adhere to if applying for a license. I'll let your imagination wonder on that last part as mine does. The choice is easy for me between asymmetric crypto that's patent-free and a kind the NSA controls. This might not apply to your personal use but it can to any company using such a…

Ed25519 and Curve25519 are not encumbered by any patents, see http://cr.yp.to/ecdh/patents.html and http://ed25519.cr.yp.to/software.html . You should prefer state-of-the-art elliptic curve systems to RSA and finite field DH.

I appreciate the update on the situation for those curves.

Re: Signify: Securing OpenBSD from Us to You

#29

Post by [deleted] » Sat, Jun 13, 2015, 2:04 AM UTC

nickpsecurity wrote: post #28

sdevlin wrote: post #19

Earlier quoted context omitted.

Ed25519 and Curve25519 are not encumbered by any patents, see http://cr.yp.to/ecdh/patents.html and http://ed25519.cr.yp.to/software.html . You should prefer state-of-the-art elliptic curve systems to RSA and finite field DH.

I appreciate the update on the situation for those curves.

[deleted]

Re: Signify: Securing OpenBSD from Us to You

#30

Post by quesera » Sat, Jun 13, 2015, 2:13 AM UTC

kragen wrote: post #23

quesera wrote: post #21

Earlier quoted context omitted.

> NSA has a patent on ECC ... Wow, I was not aware that it was even possible for government agencies to hold patents. Is there any reasonable justification for that?

Neither the NSA nor anybody else has a patent on ECC. (And no, there is no reasonable justification for government agencies to hold patents, except to make them free to the public.) There are some patents on particular ECC techniques, as explained in http://cr.yp.to/ecdh/patents.html , but they do not cover the currently most popular ECC systems, and in any case they are mostly expired.

That's what I would have thought, but then I DuckDuckGo'ed it (awkward!)...

http://foreignpolicy.com/2014/07/30/the-nsas-patents-in-one-...

Also, from https://www.nsa.gov/research/tnw/tnw193/articles/pdfs/TNW193... (PDF):

> You may be surprised to hear that NSA seeks patents. However, many of the technologies developed by NSA not only satisfy mission requirements, but also have great potential for commercial use. Following extensive review, NSA may seek patent protection for such technologies as a way to protect and build on the US government’s (USG) investment in research and development.