Live data from Hacker News

Seriously, Stop Using RSA (2019)

blog.trailofbits.com

81–90 of 125 posts

Re: Seriously, Stop Using RSA (2019)

#81

Earlier quoted context omitted.

This is not really fair. The correct way to mint RSA keys is actually pretty simple, a naive approach works fine - it's just that doing this is slow and when people try to do something fast they keep making keys which fail the criteria you listed. The tests you've advocated make sense if somebody else picked the keys and you're worried whether they did a good job, some of these tests are mandatory for a Web PKI Certi…

> The odds of "accidentally" getting two factors that are unduly close... ... are actually pretty high with some poorly conceived key generation algorithms. There are other ways that RSA key generation can be weak, such as ROCA ( https://en.wikipedia.org/wiki/ROCA_vulnerability ).

> ... are actually pretty high with some poorly conceived key generation algorithms.

To be fair, that's what they said:

> > a naive approach works fine - it's just that doing this is slow and when people try to do something fast they keep making keys which fail the criteria you listed.

The naive way to generate a RSA key is to pick a uniformly random 1024-bit (or per your security parameter) integer, test if it's prime, and if it's not throw it out and pick a new, unrelated, 1024-bit integer, and repeat until you have two to multiply together. This will, probably, produce a secure RSA key. Definitely upwards of half of the time, assuming your primality test has sufficiently low false positive rate.

It's just ('just') painfully slow, so people almostly always optimize it. There are some optimizations that provably don't change the distribution of primes (the most obvious being marking the least significant bit so the number is never even), but history has shown that any optimization that doesn't exactly and exactingly preserve the distribution almost always turns out to introduce exploitable vulnerabilities.

Of course, even if you do it wrong it's still slower than barely-optimized ECC, and even if you do it right it still has vastly less security than a ECC key a quarter of it's size.

Re: Seriously, Stop Using RSA (2019)

#82
meh. dude seems to be conflating "don't use RSA" with "don't roll your own crypto."

If we are to believe Scott Vanstone, ECC has security proofs that RSA doesn't. And I found Scott was a pretty trustworthy guy.

So the OP has a point. It's probably easier to mess up RSA then ECC. But it's not easy to not mess up ECC, so maybe the title should have been "for the love of god, don't roll your own crypto."

Maybe look at NTRU. It's supposedly quantum resistant, so that's a plus. But for the love of god maybe don't roll your own.

I contributed to two and a half commercial implementations of RSA and I still got Bob Baldwin to review my code. Bob was hip-deep in crypto research and knew how to avoid even obscure bugs.

I miss Scott and Bob.

Also... I'm using the term "Crypto" to mean "Cryptography" and not a solution in search of a problem crypto-currency.

Still. Don't roll yer own crypto.

Re: Seriously, Stop Using RSA (2019)

#83
post #52

Earlier quoted context omitted.

“Seeming” “elegant” is not a good way of choosing cryptographic algorithms (this argument is also unfair to elegance of ECC). RSA has been in use since the 1970s and has been repeatedly shown to be extremely easy to introduce seemingly minor issue that completely break the crypto. Among the many issues are the belief that encryption is just P^^message%N. Which it is not - you must include padding, and doing that padd…

> An encryption scheme seeming elegant or understandable is not a sign of strength. Neither is age, as basic ciphers like Am+B%N have been used for thousands of years, but are trivially breakable. I don't think the argument is that "we've had RSA since the 70s". I think it's "we've had RSA since the 70s and we still can't break it".

The point is that we have, over and over again. We’ve just recently had headlines about poorly chosen p and q leading to keys being broken. There have been issues with p and q being too small, too similar, etc. Then there are people not padding correctly.

RSA sounds easy, but in reality it isn’t. It is super easy to make minor mistakes that make your scheme trivially breakable.

Re: Seriously, Stop Using RSA (2019)

#84
post #52
post #34

Sounds like the author would agree it's fine to use RSA, so long as you use an audited library with a well-designed API that makes it easy to do the right thing, and hard to do the wrong thing. This makes me wonder, if we have an RSA library as good as libsodium, is ECC really a better choice than RSA? I love libsodium and tend to choose it, but ECC seems far more mysterious to me than RSA. Curve25519 is much newer,…

“Seeming” “elegant” is not a good way of choosing cryptographic algorithms (this argument is also unfair to elegance of ECC). RSA has been in use since the 1970s and has been repeatedly shown to be extremely easy to introduce seemingly minor issue that completely break the crypto. Among the many issues are the belief that encryption is just P^^message%N. Which it is not - you must include padding, and doing that padd…

> the belief that encryption is just P^^message%N. Which it is not - you must include padding, and doing that padding wrong also breaks the security.

Actually, even that is wrong; you can't[0] securely pad a message; you have to use P^(K:=rand(N)), then use K (or preferably H(K)) as a symmetric encryption key to encrypt the actual message.

0: outside of a handful of special cases, of which `rand(N)` is the only example I'm reasonably confident in

Re: Seriously, Stop Using RSA (2019)

#85
post #52
post #34

Sounds like the author would agree it's fine to use RSA, so long as you use an audited library with a well-designed API that makes it easy to do the right thing, and hard to do the wrong thing. This makes me wonder, if we have an RSA library as good as libsodium, is ECC really a better choice than RSA? I love libsodium and tend to choose it, but ECC seems far more mysterious to me than RSA. Curve25519 is much newer,…

“Seeming” “elegant” is not a good way of choosing cryptographic algorithms (this argument is also unfair to elegance of ECC). RSA has been in use since the 1970s and has been repeatedly shown to be extremely easy to introduce seemingly minor issue that completely break the crypto. Among the many issues are the belief that encryption is just P^^message%N. Which it is not - you must include padding, and doing that padd…

Another downside is that ciphertext is also quite bulky.

Re: Seriously, Stop Using RSA (2019)

#86
post #10

Is there any new concern that Curve25519 has been backdoored by the NSA? It looks like P-256 did a long time ago, and reading the Wikipedia article doesn't give that impression, wanted to check though.

A backdoor in Curve25519 hasn’t really been a concern, because unlike P-256, the parameters for the curve didn’t come from NIST. Curve25519 is a djb ( https://en.wikipedia.org/wiki/Daniel_J._Bernstein ) special. So unless djb was secretly working with the NSA and willing to risk his reputation to backdoor a highly scrutinized elliptic curve, the risk is low.

More importantly (because that's definitely something the NSA would try to do), curve25519 has fewer degrees of freedom to hide a backdoor in than P-256; 2^255-19 is the largest uint255 that's prime, and the other parameters (mostly the coefficent A=486662) were chosen by a similar "first value that satisified the security requirements" process - there's a paper by DJB explaining the parameter selection rationale around somewhere[0], although they could definitely stand to be more conspicuous about it.

0: The value of A is (poorly) explained in passing in https://cr.yp.to/ecdh/curve25519-20060209.pdf under heading "Why this curve?", but that doesn't explain any details for someone who's not a cryptographer.

Re: Seriously, Stop Using RSA (2019)

#87
post #10

Is there any new concern that Curve25519 has been backdoored by the NSA? It looks like P-256 did a long time ago, and reading the Wikipedia article doesn't give that impression, wanted to check though.

A backdoor in Curve25519 hasn’t really been a concern, because unlike P-256, the parameters for the curve didn’t come from NIST. Curve25519 is a djb ( https://en.wikipedia.org/wiki/Daniel_J._Bernstein ) special. So unless djb was secretly working with the NSA and willing to risk his reputation to backdoor a highly scrutinized elliptic curve, the risk is low.

I believe that the thing is more that DJB created that huge paper about how to create a curve so that everybody can know it's not backdoored, with advice that appears to be almost unanimous, and created Curve25519 by following it.

It's not a matter of trusting him, instead, it's a matter of using the algorithm that requires less trust of them all (including RSA).

Re: Seriously, Stop Using RSA (2019)

#88
post #75
post #34

Sounds like the author would agree it's fine to use RSA, so long as you use an audited library with a well-designed API that makes it easy to do the right thing, and hard to do the wrong thing. This makes me wonder, if we have an RSA library as good as libsodium, is ECC really a better choice than RSA? I love libsodium and tend to choose it, but ECC seems far more mysterious to me than RSA. Curve25519 is much newer,…

ECDSA is a lot computationally cheaper for the same strength. Switching from RSA to ECDSA TLS certs can have a significant impact on the CPU usage for, say a reverse proxy. (By extension, costs less in terms of money and environmental impact). That being said, I do think that global monoculture and putting all eggs in one basket as a society is a bad idea. If you're willing to take the cost and prefer to use somethin…

Of course it is a bad idea. See OpenSSL.

Re: Seriously, Stop Using RSA (2019)

#89

There's an extremely interesting rebuttal that appears as a comment in the original article. I'm going to quote it below for the benefit of HN readers. /QUOTE Bob, February 28, 2020 at 12:15 KEEP USING RSA! This article is misleading to make it appear that RSA is not secure, but only the only evidence presented is improper implementation. Properly implemented RSA has been proven secure and unbreakable by the NSA with…

I'm not sure how Snowden or Lavabit represent a "case study" in favor of RSA over ECC. My recollection is that the federal government never cracked Lavabit's encryption, and that all interactions with the government came in the form of (sometimes gagged) court orders.

Re: Seriously, Stop Using RSA (2019)

#90
post #88
post #75

Earlier quoted context omitted.

ECDSA is a lot computationally cheaper for the same strength. Switching from RSA to ECDSA TLS certs can have a significant impact on the CPU usage for, say a reverse proxy. (By extension, costs less in terms of money and environmental impact). That being said, I do think that global monoculture and putting all eggs in one basket as a society is a bad idea. If you're willing to take the cost and prefer to use somethin…

Of course it is a bad idea. See OpenSSL.

Could you elaborate on how you think that is relevant to what I wrote?
Post reply on HN