Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Upgrade your SSH keys

blog.g3rt.nl

Post reply on HN
Print view View original

151–159 of 159 posts

Re: Upgrade your SSH keys

#151

Post by yo-code-sucks »

sillysaurus3 wrote: post #88
Godel_unicode wrote: post #87

Earlier quoted context omitted.

If you're concerned about hostname leakage in your pubkeys, you're almost certainly doing something wrong.

If you want SSH access to Github or Gitlab, you'll need to paste your pubkey there. Leaking your user@host can be a concern if you're trying to maintain anonymity, e.g. Gwern, particularly if your username is your real name. You can strip out the user@host part from the paste, but it's safer to just get rid of it. It's easy to accidentally paste the whole thing into an .ssh/authorized_keys file, for example. Admitted…

Leaking? Thats not leaking, it's the comment field of the key, you can change it to anything you'd like using -C

ssh-keygen -b 4096 -t rsa -C someshitidontwanttotellyou

Re: Upgrade your SSH keys

#152

Post by pfg »

mSparks wrote: post #150
pfg wrote: post #147

Earlier quoted context omitted.

As both rockdoe and hannob have mentioned, ed25519 provides the same attack resistance as a 128-bit symmetric cipher. This is even mentioned in the original DJB ed25519 paper: > High security level. This system has a 2^128 security target; breaking it has similar difficulty to breaking NIST P-256, RSA with ≈ 3000-bit keys, strong 128-bit block ciphers, etc. (The same techniques would also produce speed improvements a…

->similar difficulty to breaking NIST P-256 which takes our comp sci lab 35 seconds on a cluster of 8 machines. so still no.

If that's possible, I'm sure you'll have no difficulty finding a public source to cite that states the same.

Re: Upgrade your SSH keys

#153

Post by mSparks »

pfg wrote: post #152
mSparks wrote: post #150

Earlier quoted context omitted.

->similar difficulty to breaking NIST P-256 which takes our comp sci lab 35 seconds on a cluster of 8 machines. so still no.

If that's possible, I'm sure you'll have no difficulty finding a public source to cite that states the same.

All the public sources I've found say it is secure.

Except for the ones recommending 512bit EC's

Perhaps you can find the parameters for a 512bit,non NIST EC and we can both be happy?

Otherwise I'll stick with 8000 and 15424 RSA thnx.

Re: Upgrade your SSH keys

#154

Post by mSparks »

svenfaw wrote: post #103
mSparks wrote: post #80

Earlier quoted context omitted.

even if that is true. its still not enough to protect anything of value.

Absolutely incorrect. Anything above 90-100 bits of effective (symmetric) strength is currently more than enough, even against nation state actors.

112 bit effective strength has been the required MINIMUM for FIPS/NIST since 2014. ->and that is just to protect you from NON nation state actors.

http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublic...

Plus, we KNOW they were routinely breaking 64bit effective strength since the 90s, 30 years on we need a lot lot more than twice the strength, even against half decent hackers - but changing the backbone is considered "too expensive".

So that isn't ME saying the US doesn't have anything valuable enough to protect. Its the US standards agencies.

Re: Upgrade your SSH keys

#155

Post by willthames »

mSparks wrote: post #154
svenfaw wrote: post #103

Earlier quoted context omitted.

Absolutely incorrect. Anything above 90-100 bits of effective (symmetric) strength is currently more than enough, even against nation state actors.

112 bit effective strength has been the required MINIMUM for FIPS/NIST since 2014. ->and that is just to protect you from NON nation state actors. http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublic... Plus, we KNOW they were routinely breaking 64bit effective strength since the 90s, 30 years on we need a lot lot more than twice the strength, even against half decent hackers - but changing the backbone is co…

128 bits isn't twice as strong as 64 bits. 65 bits is twice as strong as 64 bits. 2^64 ~= 10^19 - or 10 million million million times stronger.

Re: Upgrade your SSH keys

#156

Post by mSparks »

willthames wrote: post #155
mSparks wrote: post #154

Earlier quoted context omitted.

112 bit effective strength has been the required MINIMUM for FIPS/NIST since 2014. ->and that is just to protect you from NON nation state actors. http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublic... Plus, we KNOW they were routinely breaking 64bit effective strength since the 90s, 30 years on we need a lot lot more than twice the strength, even against half decent hackers - but changing the backbone is co…

128 bits isn't twice as strong as 64 bits. 65 bits is twice as strong as 64 bits. 2^64 ~= 10^19 - or 10 million million million times stronger.

technically its around ln(n)ln(ln(n)) stronger "best case"

thats a lot closer to 2 than 10 million million million

whoever taught you integer factorisation and the dlp are order c^n was either lying to you or had been lied to.

Re: Upgrade your SSH keys

#157

Post by technion »

zahllos wrote: post #125
tete wrote: post #105

Something I don't understand is the "hate" that RSA gets. Yeah, Elliptic Curves are promising, have benefits (smaller/faster). But RSA isn't broken, it is well understood, is "boring" (a plus on security, usually), has bigger bit sizes (according to people that know a lot more to me that's a plus point, regardless of EC requiring smaller ones, because of certain attacks), isn't hyped and sponsored by the NSA and isn'…

The bit size of the RSA modulus and the bit size of ECC keys aren't really comparable, as what matters is the number of operations required to break the primitive. A better comparison exists between multiplicative group crypto (DH/DSA) and their Elliptic Curve variants. In multiplicative group crypto there is a trivial, obvious mapping to the ring of integers (in less mathematical terms, "factorization makes sense"),…

    but implementing RSA for use in the wild is fraught with difficulties
Side question, is there a comprehensive list of those issues/requirements anywhere? I built a list of about five requirements based on the Cryptopals challenges I'm fairly sure there's more. Before anyone asks, this is an academic interest rather than an attempt to implement crypto.

Re: Upgrade your SSH keys

#158

Post by ultramancool »

mkj wrote: post #67
ultramancool wrote: post #61

Earlier quoted context omitted.

> That is a concern for the DH key establishment though, that might be decrypted in future. If you're paranoid, configure your SSH server to only accept Curve25519-based key exchanges, only use AES with authenticated modes or CTR+ETM or chacha/poly1305, and only take ed25519 or long RSA authentication keys. Assuming your clients are up to date it should work without any major impact. I also strongly recommend rejecti…

Won't the quantum computer break the curve25519 key exchange?

Yes, eventually, but there's a lot bigger concerns than quantum computers currently.

Re: Upgrade your SSH keys

#159

Post by ericfrederich »

MichaelRenor wrote: post #3

I disagree with the author. Before you go upgrading into ed25519, beware that the NSA/NIST is moving away from elliptical curve cryptography because it's very vulnerable to cracking with quantum attacks[0]. "So let me spell this out: despite the fact that quantum computers seem to be a long ways off and reasonable quantum-resistant replacement algorithms are nowhere to be seen, NSA decided to make this announcement p…

Are we not questioning the NSA's motives here given recent events?

"Don't use elliptical curve crypto because it's vulnerable to quantum attacks... keep using the stuff that is vulnerable to our in-house attacks"

Post reply on HN