4 ms·

It needs to be noted that RSA as a whole is discouraged in favour of elliptic encryption. RSA is difficult to use correctly, one needs the data to be padded co

It needs to be noted that RSA as a whole is discouraged in favour of elliptic encryption. RSA is difficult to use correctly, one needs the data to be padded correctly (OAEP), the prime numbers ideally should be Sophie-Germain primes and the keys need to be longer and longer which causes other problems related to prime generation. See: http://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography http://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography

tptacek 17y ago
There may not be a single person on Hacker News, including Colin, who knows enough to implement ECC safely. It's got at least as many easy dealbreaker pitfalls as RSA. You don't need OAEP to make RSA work for signing.
- shin_lao 17y ago
  Well... You rarely implement the algorithm yourself, do you? It's a project by itself.
  - NateLawson 17y ago
    Tarsnap implements its own crypto algorithms, partially on top of the SSL bignum functions. This is scary (yet another critical part that needs review) but also could help it achieve a higher level of assurance because OpenSSL's RSA implementation is a mess and much harder to review. Note I am not saying that it is good to implement your own algorithms, just pointing out the sorry state we're at with existing libraries.
- cperciva 17y ago
  There may not be a single person on Hacker News, including Colin, who knows enough to implement ECC safely. Yep. ECC is messy. I don't use it, for the very simple reason that I wouldn't trust an ECC implementation that I wrote. I might trust DJB's ECC code; but I'd be really uncomfortable with using it unless I had spent at least a few weeks checking it over. It's got at least as many easy dealbreaker pitfalls as RSA. s/at least as many/many many more/ You don't need OAEP to make RSA work for signing. No, but you do need PSS if you want to do things right; and PSS is basically the "natural" translation of OAEP from encryption to signing.
  - NateLawson 17y ago
    I agree. The randomized RSA modes (OAEP and PSS) are preferable to the old constant ones (PKCS #1 v1.5). They are better from a theoretical perspective and also from the fact that the randomization may protect you against an attack even in the face of some (but not all!) implementation flaws. They offer both better theoretical security and defense-in-depth.

tptacek 17y ago

There may not be a single person on Hacker News, including Colin, who knows enough to implement ECC safely. It's got at least as many easy dealbreaker pitfalls as RSA. You don't need OAEP to make RSA work for signing.

shin_lao 17y ago
Well... You rarely implement the algorithm yourself, do you? It's a project by itself.
- NateLawson 17y ago
  Tarsnap implements its own crypto algorithms, partially on top of the SSL bignum functions. This is scary (yet another critical part that needs review) but also could help it achieve a higher level of assurance because OpenSSL's RSA implementation is a mess and much harder to review. Note I am not saying that it is good to implement your own algorithms, just pointing out the sorry state we're at with existing libraries.
cperciva 17y ago
There may not be a single person on Hacker News, including Colin, who knows enough to implement ECC safely. Yep. ECC is messy. I don't use it, for the very simple reason that I wouldn't trust an ECC implementation that I wrote. I might trust DJB's ECC code; but I'd be really uncomfortable with using it unless I had spent at least a few weeks checking it over. It's got at least as many easy dealbreaker pitfalls as RSA. s/at least as many/many many more/ You don't need OAEP to make RSA work for signing. No, but you do need PSS if you want to do things right; and PSS is basically the "natural" translation of OAEP from encryption to signing.
- NateLawson 17y ago
  I agree. The randomized RSA modes (OAEP and PSS) are preferable to the old constant ones (PKCS #1 v1.5). They are better from a theoretical perspective and also from the fact that the randomization may protect you against an attack even in the face of some (but not all!) implementation flaws. They offer both better theoretical security and defense-in-depth.