5 ms·

I'm with you on this one. This 'RSA is evil' conclusion is like taking a look at [1]---or the gazillion Schnorr-style signature scheme nonce leaks published ove

by pbsd 11y ago

I'm with you on this one. This 'RSA is evil' conclusion is like taking a look at [1]---or the gazillion Schnorr-style signature scheme nonce leaks published over the years---and concluding that elliptic curves are evil. [1] http://web-in-security.blogspot.com/2015/09/practical-invalid-curve-attacks.html http://web-in-security.blogspot.com/2015/09/practical-invali...

tptacek 11y ago
I concede that "RSA is obsolete" is somewhat hyperbolic, given OAEP and PSS, but RSA is dangerous, more dangerous than modern curve crypto. Developers overestimate their ability to mitigate dangers.
- cperciva 11y ago
  I think developers of elliptic curve crypto overestimate their ability too. Avoiding side channels in RSA is easier than avoiding them in ECC - fewer moving parts.
  - CiPHPerCoder 11y ago
    In my experience, this is how developers see crypto: RSA: "I learned that as an undergrad. It's just multiplication, I'll use GMP!" ECC: "Whoa what the hell is this? I better use a library." These are the same developers who ask on StackOverflow how to decrypt MD5, of course.
    - eru 11y ago
      > These are the same developers who ask on StackOverflow how to decrypt MD5, of course. Rainbow tables. Duh!
      - CiPHPerCoder 11y ago
        That's not decryption.
        eru 11y ago
        Of course, not. (Though I wonder if you can make a pedantic argument, that if the domain of your one-way function is suitably restricted (eg to passwords humans actually come up with) they do become bijective.)
  - tptacek 11y ago
    Developers that are likely to expose exploitable side channels in curve software are just as likely to expose them in RSA software. But developers that use curve software are going to avoid a bunch of vulnerabilities that are specific to RSA. They should use curves, and avoid RSA. But I don't know why I'm letting you off the hook on this. Can you be as specific as you can about the additional moving parts you're referring to? Is your comment about the difficulty of getting constant time key agreement or verification specific to legacy Weierstrass curves? And are you concerned about timing leaks in something other than scalar multiplication? If so, what are those other things? When you say there are "more moving parts", are you referring to the fact that there's both a modular reduction and a scalar multiplication that need to be protected?
    - jsmthrowaway 11y ago
      The amount I tend to learn after you get invested in a thread and start busting out things I've never heard of is honestly my counterpoint to arguing on the Internet being unproductive. That it is Percival you are fencing makes me look forward to the rest of this thread, because EC vs RSA is an interesting dialogue and you both have a lot to say on it. It might look like arguing to both of you, but scraps of useful information do fling off and I appreciate your arguing. This thread and others like it make me think we need a security (and general) debate series.
      - tptacek 11y ago
        Colin and 'pbsd are much smarter than me, and learning stuff is actually why I'm so happy to pick fights with them. I was a blog-arguer before HN, and a Usenet person before blogs, and a BBS person before that, and most of what I've learned in my whole career is traceable somehow to Internet arguments. I really do think I'm right about RSA, though.
        jsmthrowaway 11y ago
        I come back to my debate point. I think tech is in a state now where we definitely have personal policy positions but as engineers, we are reluctant to frame what we do that way. This is in contrast to politics where most issues are acceptably on a spectrum, because that is more of a "soft" field. I suspect "RSA is obsolete" is one of those things where you've carved out a position on one end, much like Schneier carved out his position on one end of curves as discussed upthread. I'm not calling you wrong, mind, as that comparison might imply: just a surprising opinion and you've certainly earned it, and I like hearing about it, and I think of you as one colorful end of a spectrum on this and a few other points. And throughout my life the extreme opinions have often panned out (i.e. Snowden), so I don't dismiss them much any more. Maybe you're crypto's Bernie. Feel the Ptacek.

by pbsd 11y ago

tptacek 11y ago

I concede that "RSA is obsolete" is somewhat hyperbolic, given OAEP and PSS, but RSA is dangerous, more dangerous than modern curve crypto. Developers overestimate their ability to mitigate dangers.

cperciva 11y ago
I think developers of elliptic curve crypto overestimate their ability too. Avoiding side channels in RSA is easier than avoiding them in ECC - fewer moving parts.
- CiPHPerCoder 11y ago
  In my experience, this is how developers see crypto: RSA: "I learned that as an undergrad. It's just multiplication, I'll use GMP!" ECC: "Whoa what the hell is this? I better use a library." These are the same developers who ask on StackOverflow how to decrypt MD5, of course.
  - eru 11y ago
    > These are the same developers who ask on StackOverflow how to decrypt MD5, of course. Rainbow tables. Duh!
    - CiPHPerCoder 11y ago
      That's not decryption.
      - eru 11y ago
        Of course, not. (Though I wonder if you can make a pedantic argument, that if the domain of your one-way function is suitably restricted (eg to passwords humans actually come up with) they do become bijective.)
- tptacek 11y ago
  Developers that are likely to expose exploitable side channels in curve software are just as likely to expose them in RSA software. But developers that use curve software are going to avoid a bunch of vulnerabilities that are specific to RSA. They should use curves, and avoid RSA. But I don't know why I'm letting you off the hook on this. Can you be as specific as you can about the additional moving parts you're referring to? Is your comment about the difficulty of getting constant time key agreement or verification specific to legacy Weierstrass curves? And are you concerned about timing leaks in something other than scalar multiplication? If so, what are those other things? When you say there are "more moving parts", are you referring to the fact that there's both a modular reduction and a scalar multiplication that need to be protected?
  - jsmthrowaway 11y ago
    The amount I tend to learn after you get invested in a thread and start busting out things I've never heard of is honestly my counterpoint to arguing on the Internet being unproductive. That it is Percival you are fencing makes me look forward to the rest of this thread, because EC vs RSA is an interesting dialogue and you both have a lot to say on it. It might look like arguing to both of you, but scraps of useful information do fling off and I appreciate your arguing. This thread and others like it make me think we need a security (and general) debate series.
    - tptacek 11y ago
      Colin and 'pbsd are much smarter than me, and learning stuff is actually why I'm so happy to pick fights with them. I was a blog-arguer before HN, and a Usenet person before blogs, and a BBS person before that, and most of what I've learned in my whole career is traceable somehow to Internet arguments. I really do think I'm right about RSA, though.
      - jsmthrowaway 11y ago
        I come back to my debate point. I think tech is in a state now where we definitely have personal policy positions but as engineers, we are reluctant to frame what we do that way. This is in contrast to politics where most issues are acceptably on a spectrum, because that is more of a "soft" field. I suspect "RSA is obsolete" is one of those things where you've carved out a position on one end, much like Schneier carved out his position on one end of curves as discussed upthread. I'm not calling you wrong, mind, as that comparison might imply: just a surprising opinion and you've certainly earned it, and I like hearing about it, and I think of you as one colorful end of a spectrum on this and a few other points. And throughout my life the extreme opinions have often panned out (i.e. Snowden), so I don't dismiss them much any more. Maybe you're crypto's Bernie. Feel the Ptacek.