5 ms·

Well the article is certainly informative why not to self-implement RSA, but the conclusion to just use libsodium seems stupid. I don't really know cryptography

by Hitton 7y ago

Well the article is certainly informative why not to self-implement RSA, but the conclusion to just use libsodium seems stupid. I don't really know cryptography, but I'm sure there are libraries that implement RSA correctly and could be easily used instead.

dagenix 7y ago
> I don't really know cryptography, but I'm sure there are libraries that implement RSA correctly and could be easily used instead. In one sentence you admit you have limited knowledge of the field and then immediately make a definitive statement about the field. Bold.
tabletopneedle 7y ago
Even if you were using a perfect implementation of RSA-OAEP, it would still be less secure than Diffie-Hellman over Curve25519 (called X25519) or Curve448 (called X448). This is because RSA lacks forward secrecy: If the private RSA key is stolen, it can be used to retrospectively decrypt all past communication. Also X448 provides the equivalent security of ~15000-bit RSA with a fraction of the key size, and key generation takes milliseconds instead of minutes. tl;dr For key exchange, use X25519 or X448. For digital signatures, use Curve25519-based ed25519 signatures. For authenticating communication, use authenticating encryption like ChaCha20-Poly1305 or Salsa20-Poly1305 or AES256-GCM. For hash function, use Blake2 or SHA3-256 or SHA256.
- Modulusmath 7y ago
  You can only decrypt the past sessions if you also captured the initial handshake of the TCP connection.
- Hitton 7y ago
  As I said, I don't really know much about, but this is bullshit. RSA lacks perfect forward secrecy is same as saying that ECDH lacks perfect forward secrecy. Both is true, and both can be used with ephemeral keys, which provide forward secrecy to both (and therefore must use other way to authenticate). Claiming that it's somehow RSA's problem while willfully pretending that it doesn't concern elliptic curve cryptography is very dishonest.

by Hitton 7y ago

dagenix 7y ago

> I don't really know cryptography, but I'm sure there are libraries that implement RSA correctly and could be easily used instead. In one sentence you admit you have limited knowledge of the field and then immediately make a definitive statement about the field. Bold.

tabletopneedle 7y ago

Even if you were using a perfect implementation of RSA-OAEP, it would still be less secure than Diffie-Hellman over Curve25519 (called X25519) or Curve448 (called X448). This is because RSA lacks forward secrecy: If the private RSA key is stolen, it can be used to retrospectively decrypt all past communication. Also X448 provides the equivalent security of ~15000-bit RSA with a fraction of the key size, and key generation takes milliseconds instead of minutes. tl;dr For key exchange, use X25519 or X448. For digital signatures, use Curve25519-based ed25519 signatures. For authenticating communication, use authenticating encryption like ChaCha20-Poly1305 or Salsa20-Poly1305 or AES256-GCM. For hash function, use Blake2 or SHA3-256 or SHA256.

Modulusmath 7y ago
You can only decrypt the past sessions if you also captured the initial handshake of the TCP connection.
Hitton 7y ago
As I said, I don't really know much about, but this is bullshit. RSA lacks perfect forward secrecy is same as saying that ECDH lacks perfect forward secrecy. Both is true, and both can be used with ephemeral keys, which provide forward secrecy to both (and therefore must use other way to authenticate). Claiming that it's somehow RSA's problem while willfully pretending that it doesn't concern elliptic curve cryptography is very dishonest.