14 ms·

Totally different kind of cryptography. sec256k1 is an elliptic curve, and 256-bit elliptic curves are generally believed to provide comparable security to 307

Totally different kind of cryptography. sec256k1 is an elliptic curve, and 256-bit elliptic curves are generally believed to provide comparable security to 3072-bit RSA or DH or ElGamal. (See https://www.keylength.com https://www.keylength.com for a good compilation of reputable comparisons along these lines.)

jasonzemos 7y ago
When I click the reference footnote on that page leading to iad.gov I get an invalid certificate authority error, heh. https://www.iad.gov/iad/library/ia-guidance/ia-solutions-for-classified/algorithm-guidance/commercial-national-security-algorithm-suite-factsheet.cfm https://www.iad.gov/iad/library/ia-guidance/ia-solutions-for...)
- nwallin 7y ago
  For obvious reasons, the US government was never an authorized CA in firefox, and the application to be put on the list of trusted CAs was denied. The DoD root cert (for .mil addresses) is similarly distrusted. AFAIK most other browsers operate similarly. If you so desire, you can simply add the FCPCA and DoD certs to your trust store. Or... you know.. not. https://wiki.mozilla.org/CA:GovernmentCAs https://wiki.mozilla.org/CA:GovernmentCAs https://bugzilla.mozilla.org/show_bug.cgi?id=478418 https://bugzilla.mozilla.org/show_bug.cgi?id=478418 (Status: RESOLVED WONTFIX) https://fpki.idmanagement.gov/crls/ https://fpki.idmanagement.gov/crls/ https://www.dau.edu/faq/p/DoD-PKI-Certificates https://www.dau.edu/faq/p/DoD-PKI-Certificates Although it kinda makes you wonder why China's CA was trusted by default, and it took actual, in-the-wild fraudulent certs before it was revoked.
  - Jwarder 7y ago
    My understanding is that the FPKI has tons of sub-CAs all doing their own thing and thus couldn't meet the Baseline Requirements. If they could meet the BRs then I'm sure the public comments would be full of comments about the NSA et al, but pre-CNNIC Mozilla was a lot more willing to follow a technical checklist for approval. The the recent DarkMatter request indicates the process isn't so trusting anymore.
  - ryebit 7y ago
    Shame you can't add CAs for a particular set of subdomains, that it's all or nothing.
    - nwallin 7y ago
      Yeah it really doesn't make any sense that it's not that way. I'd very much like to add the fcpca cert for .gov addresses and dod cert for .mil addresses, as I sometimes use these TLDs for work, but it doesn't make any sense to enable them globally. In fact I would like to ban all other CAs from those TLDs as they would be obviously fraudulent. I wouldn't have an issue adding cnnic for .cn either. While I'm at it, why can't... Nevermind. The certificate authority system is so damned broken I could sit here for hours. Arrrg.

jasonzemos 7y ago

When I click the reference footnote on that page leading to iad.gov I get an invalid certificate authority error, heh. https://www.iad.gov/iad/library/ia-guidance/ia-solutions-for-classified/algorithm-guidance/commercial-national-security-algorithm-suite-factsheet.cfm https://www.iad.gov/iad/library/ia-guidance/ia-solutions-for...)

nwallin 7y ago
For obvious reasons, the US government was never an authorized CA in firefox, and the application to be put on the list of trusted CAs was denied. The DoD root cert (for .mil addresses) is similarly distrusted. AFAIK most other browsers operate similarly. If you so desire, you can simply add the FCPCA and DoD certs to your trust store. Or... you know.. not. https://wiki.mozilla.org/CA:GovernmentCAs https://wiki.mozilla.org/CA:GovernmentCAs https://bugzilla.mozilla.org/show_bug.cgi?id=478418 https://bugzilla.mozilla.org/show_bug.cgi?id=478418 (Status: RESOLVED WONTFIX) https://fpki.idmanagement.gov/crls/ https://fpki.idmanagement.gov/crls/ https://www.dau.edu/faq/p/DoD-PKI-Certificates https://www.dau.edu/faq/p/DoD-PKI-Certificates Although it kinda makes you wonder why China's CA was trusted by default, and it took actual, in-the-wild fraudulent certs before it was revoked.
- Jwarder 7y ago
  My understanding is that the FPKI has tons of sub-CAs all doing their own thing and thus couldn't meet the Baseline Requirements. If they could meet the BRs then I'm sure the public comments would be full of comments about the NSA et al, but pre-CNNIC Mozilla was a lot more willing to follow a technical checklist for approval. The the recent DarkMatter request indicates the process isn't so trusting anymore.
- ryebit 7y ago
  Shame you can't add CAs for a particular set of subdomains, that it's all or nothing.
  - nwallin 7y ago
    Yeah it really doesn't make any sense that it's not that way. I'd very much like to add the fcpca cert for .gov addresses and dod cert for .mil addresses, as I sometimes use these TLDs for work, but it doesn't make any sense to enable them globally. In fact I would like to ban all other CAs from those TLDs as they would be obviously fraudulent. I wouldn't have an issue adding cnnic for .cn either. While I'm at it, why can't... Nevermind. The certificate authority system is so damned broken I could sit here for hours. Arrrg.