After constantly hearing all of the different revelations regarding NSA and their backdooring of various algorithms, I've totally lost track of which algorithms we should distrust and their replacements. For example, is SSH2-RSA known to be 'broken'?
Ask HN: What encryption algorithms should we take as compromised?
1–10 of 49 posts
Re: Ask HN: What encryption algorithms should we take as compromised?
#2No ssh2-rsa is not known to be broken, although it's suspected that the NSA can factor some small (It's believed that any elliptic curve algorithm that doesn't have a transparent process for choosing the curve points may have been backdoored by the NSA choosing points that they already knew how to factor. If you use those curves, then you're revealing your secrets to the NSA but not to anyone else, because the discrete log problem is still (mostly) just as hard as it ever was.
Specifically, the elliptic curve random number generator in NIST SP 800-90A is believed to have been backdoored by the NSA. For obvious reasons no one has any hard proof, just very strong circumstantial evidence.
You can continue to use SSH2-RSA with decent size (2048 bit as a minimum) keys & AES. Those are not believed to be breakable at the current time, although as ever you can never have absolute certainty in these matters!
Re: Ask HN: What encryption algorithms should we take as compromised?
#3For an n-bit RSA key "The absolute minimum size for n is 2048 bits or so if you want to protect your data for 20 years. [...] If you can afford it in your application, let n be 4096 bits long, or as close to this size as you can get it."
http://www.javamex.com/tutorials/cryptography/rsa_key_length...
Re: Ask HN: What encryption algorithms should we take as compromised?
#4It's not just about compromised encryption algorithms, it's also about picking the right algorithm for a given purpose.
For instance, an hashing algorithm can be used to securely store passwords, and must therefore be slow, or to find duplicate files, a task which greatly benefits from speed. If you use a fast hashing algorithm to "securely" store passwords you might as well use a compromised algorithm since the security is nonexistent in both cases.
I think the same applies to crypto algorithms: it doesn't matter if the building blocks are individually secure if you don't know how to put them together in a secure fashion.
Re: Ask HN: What encryption algorithms should we take as compromised?
#5This question only makes sense if you give the threat-model to consider.
Is it only classical cryptanalysis on the cryptographic algorithm? Or do you take into account the programming mistakes (not necessarily related to crypto) of specific implementations? Or do you allow side-channel or fault-injection attacks, which will be able to break most algorithms, if they are not implemented with specific countermeasures?
In anyway, it is a very difficult question which doesn't have a single definite answer.
Re: Ask HN: What encryption algorithms should we take as compromised?
#6It's not just about compromised encryption algorithms, it's also about picking the right algorithm for a given purpose. For instance, an hashing algorithm can be used to securely store passwords, and must therefore be slow, or to find duplicate files, a task which greatly benefits from speed. If you use a fast hashing algorithm to "securely" store passwords you might as well use a compromised algorithm since the secu…
Nobody is arguing against that. The OP is asking about compromised algorithms. Sure, non-compromised algorithms can still be used incorrectly and be insecure, but compromised ones won't be secure no matter how they're used.
Also, you don't use hashes to store passwords, you use KDFs.
Re: Ask HN: What encryption algorithms should we take as compromised?
#7It's not just about compromised encryption algorithms, it's also about picking the right algorithm for a given purpose. For instance, an hashing algorithm can be used to securely store passwords, and must therefore be slow, or to find duplicate files, a task which greatly benefits from speed. If you use a fast hashing algorithm to "securely" store passwords you might as well use a compromised algorithm since the secu…
Nobody is arguing against that. The OP is asking about compromised algorithms. Sure, non-compromised algorithms can still be used incorrectly and be insecure, but compromised ones won't be secure no matter how they're used. Also, you don't use hashes to store passwords, you use KDFs.
> Also, you don't use hashes to store passwords, you use KDFs.
Well, technically a hash can be seen as a particular key derivation function (KDF). Not a proper one for the purpose of storing passwords I agree, but then most KDFs are built using salt + an iteration of hash functions, to my knowledge at least (which I admit is not very deep on the subject).
Re: Ask HN: What encryption algorithms should we take as compromised?
#8No ssh2-rsa is not known to be broken, although it's suspected that the NSA can factor some small ( It's believed that any elliptic curve algorithm that doesn't have a transparent process for choosing the curve points may have been backdoored by the NSA choosing points that they already knew how to factor. If you use those curves, then you're revealing your secrets to the NSA but not to anyone else, because the discr…
> If you use those curves, then you're revealing your secrets to the NSA but not to anyone else.
...until some worker or contractor takes their "secret" values for himself, or sells them, or publishes them on the internet. Producing the public standards with the built-in master keys increases possibility of overnight global breakage.
Re: Ask HN: What encryption algorithms should we take as compromised?
#9In general you should prefer crypto constructions which are a result of global competitions.
For example AES and SHA3.
You should avoid at all costs anything that has been standardized by NIST without going through years of reviews by international cryptographers. Dual_EC_DRBG is a clear example of crypto construction which falls into this category.
This is my general rule of thumb.
However knowing which ciphers one should use is not enough! You absolutely need to know HOW to use them. A basic and superficial example is AES in ECB mode, which is semantically secure as long as you use a key to encrypt one and only one single block. Another one is, for example, after how many encrypted blocks a key should be rotated, based on the underlying cipher used.
Once you have learnt how to use the basic building blocks of crypto you are then NOT supposed to write your own implementation and instead use existing ones....there is a small problem with this....they are broken or they either not implement all the necessary crypto constructions you need. OpenSSL is an example of broken crypto implementation, and instead NaCl does not have TLS implemented.
So this is a short summary and my personal opinion of why crypto is hard. On top of all this there are not enough experts out there which have the time to review crypto implementations or new and old constructions, and we are living a historical period where we desperately need crypto to protect our privacy.
So my final suggestions is to take some of your spare time and go through Dan Boneh Crypto 1 at Coursera: https://www.coursera.org/course/crypto
It is worth every single minute.
Once you have done that, I would also suggest you to take the Matasano Crypto challenges: http://www.matasano.com/articles/crypto-challenges/
Finally I want to thank everybody who have taken their time to create and maintain both Crypto 1 course and the Matasano challenges.
Re: Ask HN: What encryption algorithms should we take as compromised?
#10If you're wondering what isn't compromised, the information here has withstood the test of time and scrutiny from the crypto community: http://www.daemonology.net/blog/2009-06-11-cryptographic-rig...
Barring some major advance in breaking crypto (which is entirely possible) it will probably stand for a long time to come.