6 ms·

Nobody seemed to answer this question, and neither did the original blog post (besides "trust me and do it"), so maybe you can shed more light on the main point

Nobody seemed to answer this question, and neither did the original blog post (besides "trust me and do it"), so maybe you can shed more light on the main point: Why are ED25519 keys better than RSA, how compatible are they with different systems, and are they worth the hassle and risk of generating and using a new one?

arca_vorago 10y ago
ED25519 keys are cryptographically more secure, and are more politically secure if you want to call it that due to the undermining of NIST the NSA was/is doing. (plus it comes from djb, all hail djb!) OpenSSH already has support built in, as does Mosh, and therefore, I do think it's worth it. I do sometimes disagree with using keys though, despite everyone pushing it so hard, there are cases where I think passwords are the way to go, but thats a long post for another time. Also, I really like usin pam auth mods, such as yubikeys or google auth for two factor. That combined with regular hardening, and yes Ill admit it, non standard ports (reduces log alert fatique) does a pretty good job.
- effie 10y ago
  > I do sometimes disagree with using keys though That sounds interesting, could you elaborate on that?
lisper 10y ago
> Why are ED25519 keys better than RSA Two reasons: 1) they are a lot shorter for the same level of security and 2) any random number can be an Ed25519 key. To generate an RSA you have to generate two large random primes, and the code that does this is complicated an so can more easily be (and in the past has been) compromised to generate weak keys.
- carlesfe 10y ago
  If I understood it correctly, you're saying that RSA requires the two numbers to be big AND random, otherwise the algorithm isn't strong? Therefore Ed25519 is better because it's strong regardless of the key? What I don't get then is how can a short key be secure, that goes against what I was taught in college. Aren't shorter keys more prone to collisions and bruteforce attacks?
  - rosser 10y ago
    Aren't shorter keys more prone to collisions and bruteforce attacks? Given the same cipher, more or less, yes. Between ciphers, though, key-lengths are less relevant, and the differences in those ciphers become more so. EDIT: Think of it in terms of Shannon Entropy: because RSA requires a pair of primes, the keyspace is so much sparser — that is to say, more "predictable" (if, granted, at a mostly theoretical level) — so keys need to be that much larger to be secure. Contrarily, with ED25519, keys can be smaller, because the keyspace is denser. (Or am I just talking out my ass here?) EDIT 2: s/smaller/sparser/, s/bigger/denser/, regarding keyspaces. Thanks, 'lisper!
    - lisper 10y ago
      Not bigger -- denser.
      - carlesfe 10y ago
        Great replies, I got it now, it makes sense. Thanks to both of you!
  - lisper 10y ago
    RSA requires two numbers which are big and random and prime. It is the primality that makes things tricky. Generating random primes is a lot harder than generating random numbers. The other factor (no pun intended) that makes RSA keys large is that there are more efficient algorithms for factoring than there are for solving the elliptic curve discrete log problem, e.g. https://en.wikipedia.org/wiki/General_number_field_sieve https://en.wikipedia.org/wiki/General_number_field_sieve If you crunch the numbers on this you will find that a 2000-bit RSA key has a security level of about 100 bits, i.e. it takes about 2^100 operations to factor a 2000-bit RSA key using GNFS.
    - YomiK 10y ago
      Not disagreeing, but I think both randomness and primality testing both have the problem that it's so easy to do them poorly. Generating random primes of these sizes isn't all that difficult, and even proofs can be done in reasonable time frames (e.g. under 10 seconds for 1024-bit inputs). There are also a couple random proven prime algorithms which run pretty fast. Getting software to correctly implement everything .... that seems to be hard.
duaneb 10y ago
Note that ED25519 is more vulnerable to quantum computation than is RSA.
- rosser 10y ago
  If, like most such claims I've seen lately, you're referring to No Such Agency's recommendation against adopting Suite B, the reasons behind that move seemed to me not to be about ECC being "more" QC vulnerable than RSA. They simply said, "If you haven't made this switch already, just keep using RSA while we figure this whole 'quantum' thing out." ECC and RSA are both ultimately going to fall to practical quantum computing, and probably over a time frame short enough that it won't matter which cipher you picked.

arca_vorago 10y ago

ED25519 keys are cryptographically more secure, and are more politically secure if you want to call it that due to the undermining of NIST the NSA was/is doing. (plus it comes from djb, all hail djb!) OpenSSH already has support built in, as does Mosh, and therefore, I do think it's worth it. I do sometimes disagree with using keys though, despite everyone pushing it so hard, there are cases where I think passwords are the way to go, but thats a long post for another time. Also, I really like usin pam auth mods, such as yubikeys or google auth for two factor. That combined with regular hardening, and yes Ill admit it, non standard ports (reduces log alert fatique) does a pretty good job.

effie 10y ago
> I do sometimes disagree with using keys though That sounds interesting, could you elaborate on that?

lisper 10y ago

> Why are ED25519 keys better than RSA Two reasons: 1) they are a lot shorter for the same level of security and 2) any random number can be an Ed25519 key. To generate an RSA you have to generate two large random primes, and the code that does this is complicated an so can more easily be (and in the past has been) compromised to generate weak keys.

carlesfe 10y ago
If I understood it correctly, you're saying that RSA requires the two numbers to be big AND random, otherwise the algorithm isn't strong? Therefore Ed25519 is better because it's strong regardless of the key? What I don't get then is how can a short key be secure, that goes against what I was taught in college. Aren't shorter keys more prone to collisions and bruteforce attacks?
- rosser 10y ago
  Aren't shorter keys more prone to collisions and bruteforce attacks? Given the same cipher, more or less, yes. Between ciphers, though, key-lengths are less relevant, and the differences in those ciphers become more so. EDIT: Think of it in terms of Shannon Entropy: because RSA requires a pair of primes, the keyspace is so much sparser — that is to say, more "predictable" (if, granted, at a mostly theoretical level) — so keys need to be that much larger to be secure. Contrarily, with ED25519, keys can be smaller, because the keyspace is denser. (Or am I just talking out my ass here?) EDIT 2: s/smaller/sparser/, s/bigger/denser/, regarding keyspaces. Thanks, 'lisper!
  - lisper 10y ago
    Not bigger -- denser.
    - carlesfe 10y ago
      Great replies, I got it now, it makes sense. Thanks to both of you!
- lisper 10y ago
  RSA requires two numbers which are big and random and prime. It is the primality that makes things tricky. Generating random primes is a lot harder than generating random numbers. The other factor (no pun intended) that makes RSA keys large is that there are more efficient algorithms for factoring than there are for solving the elliptic curve discrete log problem, e.g. https://en.wikipedia.org/wiki/General_number_field_sieve https://en.wikipedia.org/wiki/General_number_field_sieve If you crunch the numbers on this you will find that a 2000-bit RSA key has a security level of about 100 bits, i.e. it takes about 2^100 operations to factor a 2000-bit RSA key using GNFS.
  - YomiK 10y ago
    Not disagreeing, but I think both randomness and primality testing both have the problem that it's so easy to do them poorly. Generating random primes of these sizes isn't all that difficult, and even proofs can be done in reasonable time frames (e.g. under 10 seconds for 1024-bit inputs). There are also a couple random proven prime algorithms which run pretty fast. Getting software to correctly implement everything .... that seems to be hard.

duaneb 10y ago

Note that ED25519 is more vulnerable to quantum computation than is RSA.

rosser 10y ago
If, like most such claims I've seen lately, you're referring to No Such Agency's recommendation against adopting Suite B, the reasons behind that move seemed to me not to be about ECC being "more" QC vulnerable than RSA. They simply said, "If you haven't made this switch already, just keep using RSA while we figure this whole 'quantum' thing out." ECC and RSA are both ultimately going to fall to practical quantum computing, and probably over a time frame short enough that it won't matter which cipher you picked.