4 ms·

> As RSA and finite-field DH aren't broken No, but their implementations often are. For a recent example (Zend Framework, just at the end of 2015): http://fram

> As RSA and finite-field DH aren't broken No, but their implementations often are. For a recent example (Zend Framework, just at the end of 2015): http://framework.zend.com/security/advisory/ZF2015-10 http://framework.zend.com/security/advisory/ZF2015-10 More famously: http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-d-1 http://www.cryptofails.com/post/70059600123/saltstack-rsa-e-... RSA has more knobs to turn than EdDSA, and leads greater room for implementor error.

Someone1234 10y ago
I'm confused. Above you're arguing for the use of newer schemes which are available with newer code which has not been as time-tested, here you're suggesting that the reason to avoid older well-tested schemes is poor implementation? Aren't these two points contradictory. Unless you have a reason why the new scheme's implementation is more likely to be flawless than older implementations which may have received bug fixes or reviews. Seems to me that implementation bugs are a good reason to stick to older heavily used code, rather than jumping to the latest new thing.
- marcosdumay 10y ago
  Curve25519 is very well tested too. Not as well tested as RSA, granted, but it has actually survived the testing, while RSA has several known problems. Overall, creating an RSA implementation is a minefield. There is a big number of issues you must avoid, while Curve25519 doesn't suffer from most of them.
  - geofft 10y ago
    I have no intention of creating an RSA implementation or a Curve25519 implementation. I'm going to use a high-level library that doesn't let me choose things like public exponent or padding style. If the high-level libraries out there for X25519 are better-tested and less likely to get things wrong than those for RSA, sure, but that would be pretty surprising.
    - CiPHPerCoder 10y ago
      Here's a high-level library: https://github.com/paragonie/halite https://github.com/paragonie/halite It uses libsodium, which only offers X25519/Ed25519 for public key crypto.
    - marcosdumay 10y ago
      So, be surprised. They are. Implementing RSA has many, many pitfalls. People are finding vulnerabilities on those libraries all the time. Now, take a look at libsodim source code - it's simple and direct, no special cases anywhere, no tests for validity. The only concern is with stuff like if the compiler will optimize out things like zeroing the memory and the platform has constant time opcodes.
- tptacek 10y ago
  You're confused because you're unfamiliar with the concepts being discussed. That's not the same thing as being confused because the parent comment's argument is flawed. RSA is dangerous for a bunch of reasons: * It has selectable key sizes and performance parameters that beg people to deploy it insecurely. That's the concept you're probably roughly familiar with. * It is subject to a far greater diversity of implementation faults (for instance: because of its padding requirements, or because of its relatively complicated key generation process) than alternative algorithms. * It offers one primitive operation you actually want (signatures) along with one you almost never want (encryption), which results in cryptosystems like classical TLS or, worse, every system that ever directly encrypted a credit card number with RSA. Alternative algorithms don't offer this foot-gun. * The underlying mathematics of RSA are weakening(/improving) faster than those of elliptic curve; we could lose RSA entirely within our lifetimes even if quantum doesn't come to pass. You don't have to take my word for it. Survey modern cryptosystems. Note which ones depend on curves and which depend on RSA, and then investigate the reputations of each of those systems.
  - Someone1234 10y ago
    > You're confused because you're unfamiliar with the concepts being discussed. That's not the same thing as being confused because the parent comment's argument is flawed. That's very unnecessarily condescending. You then go on to criticise RSA, which is fine, but fails to address the point I made which was that they criticised RSA's implementation, not its inherent design flaws, while promoting a newer scheme with a less time-tested implementation. This is verbatim what I was responding to: > As RSA and finite-field DH aren't broken >> No, but their implementations often are. PS - I strongly suspect your tone is a result of another thread of discussion we had in this topic[0]. I'd suggest you make snide remarks there rather than carrying it over into this thread. [0] https://news.ycombinator.com/item?id=11909436 https://news.ycombinator.com/item?id=11909436
    - tptacek 10y ago
      None of this is responsive to the comment I just wrote. I'm pretty happy to leave this part of the thread where it is, though.

Someone1234 10y ago

I'm confused. Above you're arguing for the use of newer schemes which are available with newer code which has not been as time-tested, here you're suggesting that the reason to avoid older well-tested schemes is poor implementation? Aren't these two points contradictory. Unless you have a reason why the new scheme's implementation is more likely to be flawless than older implementations which may have received bug fixes or reviews. Seems to me that implementation bugs are a good reason to stick to older heavily used code, rather than jumping to the latest new thing.

marcosdumay 10y ago
Curve25519 is very well tested too. Not as well tested as RSA, granted, but it has actually survived the testing, while RSA has several known problems. Overall, creating an RSA implementation is a minefield. There is a big number of issues you must avoid, while Curve25519 doesn't suffer from most of them.
- geofft 10y ago
  I have no intention of creating an RSA implementation or a Curve25519 implementation. I'm going to use a high-level library that doesn't let me choose things like public exponent or padding style. If the high-level libraries out there for X25519 are better-tested and less likely to get things wrong than those for RSA, sure, but that would be pretty surprising.
  - CiPHPerCoder 10y ago
    Here's a high-level library: https://github.com/paragonie/halite https://github.com/paragonie/halite It uses libsodium, which only offers X25519/Ed25519 for public key crypto.
  - marcosdumay 10y ago
    So, be surprised. They are. Implementing RSA has many, many pitfalls. People are finding vulnerabilities on those libraries all the time. Now, take a look at libsodim source code - it's simple and direct, no special cases anywhere, no tests for validity. The only concern is with stuff like if the compiler will optimize out things like zeroing the memory and the platform has constant time opcodes.
tptacek 10y ago
You're confused because you're unfamiliar with the concepts being discussed. That's not the same thing as being confused because the parent comment's argument is flawed. RSA is dangerous for a bunch of reasons: * It has selectable key sizes and performance parameters that beg people to deploy it insecurely. That's the concept you're probably roughly familiar with. * It is subject to a far greater diversity of implementation faults (for instance: because of its padding requirements, or because of its relatively complicated key generation process) than alternative algorithms. * It offers one primitive operation you actually want (signatures) along with one you almost never want (encryption), which results in cryptosystems like classical TLS or, worse, every system that ever directly encrypted a credit card number with RSA. Alternative algorithms don't offer this foot-gun. * The underlying mathematics of RSA are weakening(/improving) faster than those of elliptic curve; we could lose RSA entirely within our lifetimes even if quantum doesn't come to pass. You don't have to take my word for it. Survey modern cryptosystems. Note which ones depend on curves and which depend on RSA, and then investigate the reputations of each of those systems.
- Someone1234 10y ago
  > You're confused because you're unfamiliar with the concepts being discussed. That's not the same thing as being confused because the parent comment's argument is flawed. That's very unnecessarily condescending. You then go on to criticise RSA, which is fine, but fails to address the point I made which was that they criticised RSA's implementation, not its inherent design flaws, while promoting a newer scheme with a less time-tested implementation. This is verbatim what I was responding to: > As RSA and finite-field DH aren't broken >> No, but their implementations often are. PS - I strongly suspect your tone is a result of another thread of discussion we had in this topic[0]. I'd suggest you make snide remarks there rather than carrying it over into this thread. [0] https://news.ycombinator.com/item?id=11909436 https://news.ycombinator.com/item?id=11909436
  - tptacek 10y ago
    None of this is responsive to the comment I just wrote. I'm pretty happy to leave this part of the thread where it is, though.