5 ms·

Unless there’s a good reason for not using RSA, this is a non-issue

hyper_reality 6y ago
Check out the paper "Ron was wrong, Whit is right" for a survey of keys found on the web and the surprising number of RSA keys that have weaknesses.
- throw0101a 6y ago
  Discussion of said paper (2012): * https://news.ycombinator.com/item?id=3591429 https://news.ycombinator.com/item?id=3591429
- phkahler 6y ago
  Why do RSA keys have weaknesses? Wasn't the company found to be compromised and selling products that make weak keys or something like that?
  - rcxdude 6y ago
    completely different. RSA group != RSA the algorithm (though they were created by the same people initially).
    - phkahler 6y ago
      I may have been thinking of this: https://www.google.com/amp/s/mobile.reuters.com/article/amp/idUSBRE9BJ1C220131220 https://www.google.com/amp/s/mobile.reuters.com/article/amp/...
genr8 6y ago
There is a good reason, its just buried in complex crypto math and I won't be the one to explain it for you. If you are still using RSA, you should have upgraded to 4096 bit RSA by now. If not, you should be regenerating and changing your keys and not using one 5 or 10 year old 2048-bit RSA key because "2048 should be enough for anyone" and not thinking "I reused this key all over the place and im lazy and i'm sentimental and don't like change". People's key practices are just as bad as their password practices. His personal blog post was not meant to be a comprehensive lesson. But you can do what you want. If this is the first time you're hearing about RSA starting to be phased out, and the new Ed25519, look into it. Or click this if you're lazy. https://medium.com/risan/upgrade-your-ssh-key-to-ed25519-c6e8d60d3c54 https://medium.com/risan/upgrade-your-ssh-key-to-ed25519-c6e... Also of note, is Ed25519 does not harden itself with additional "bits" in the normal RSA sense, it relies on "rounds" of KDF to apply more brute-force protection to the passphrase (you did set a passphrase on your key right?). I would suggest using the -a option with 1000 or more rounds. If you pick 50,000 rounds you might be waiting 5 minutes to log in though. Also of note, ECDSA (the other one) has had curve trust concerns due to NIST possibly being subverted by the NSA. You can read for days on this, but bottom line is we've all agreed to move on. https://security.stackexchange.com/a/227771 https://security.stackexchange.com/a/227771 / https://safecurves.cr.yp.to/ https://safecurves.cr.yp.to/
- LeoPanthera 6y ago
  Can you please provide a citation for 2048-bit RSA not being enough? That is counter to apparently reliable advice elsewhere.
  - genr8 6y ago
    I didnt say it wasn't enough. I said you should upgrade to elliptic curve crypto, or if you have to stay on RSA, re-generate with 4096 because it's better. A 2048 bit RSA key only provides 112 bits of security - claimed to be suitable until the year 2030. RSA-2048 is still techncially ALLOWED by NIST, but that is the literal cutoff mark, below which is disallowed. The spec dates back to 2012 with "NIST Special Publication 800-57 Part1". This specification is up to Revision 5 now, the most recent of which is named "NIST Special Publication 800-57 Part 1 rev 5" published May 2020. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S... . There is no new news regarding the 2048 length since 2012. This estimate also does not factor in CLASSIFIED quantum cryptography thats hidden from the public. I personally don't trust them after the Snowden documents either. Plenty of sites are still using 2048 for compatibility and speed, but if you are re-generating your key now, its advised to upgrade to elliptic curve, or if you must stick on RSA, 3072 or 4096, because 2048 is the literal cutoff point. This document also describes the migration process. NIST SP 800-131A Rev. 2 - Transitioning the Use of Cryptographic Algorithms and Key Lengths https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/...
    - LeoPanthera 6y ago
      The GPG documentation specifically says that 4096 is not "better". https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa4096 https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa40...
      - genr8 6y ago
        4096 _does_ take a lot of extra CPU resources, and it _is_ diminishing returns. But anyone who prioritizes this above all else is arguing either from a vantage point of distributed scaling across servers that cost money to handle millions of extra cycles per key times millions of keys, or from a place of defending the status quo just for the sake of defending their past choices, which I hate. Their motives for defending it have to be questioned. The page says you gain very little, because by this point we are moving away from RSA to elliptic curves, from which you gain A LOT. Section 11.5 states: "If you need more security than RSA-2048 offers, the way to go would be to switch to elliptical curve cryptography — not to continue using RSA." This is the entire point of this HN Thread. A lot of smartcard and hardware vendors have a vested interest in the status quo 2048-bit RSA because they are stingy with embedded CPU resources or monetary resources in the cost of switching algos. And theres specifically an issue with GNUPG and Elliptic Curves and license compatibility https://www.yubico.com/blog/big-debate-2048-4096-yubicos-stand/ https://www.yubico.com/blog/big-debate-2048-4096-yubicos-sta... If you are an end-user with personal keys only, and fast computers, switching to a 3072 or 4096 bit key is a no brainer. The largest overhead of additional CPU cycles is only consumed on generation, not on verification. Interoperability is nearly always ensured, and you gain some 16% percent security (which is NOT "almost nothing"). Beyond that, you should switch to Ed25519 (which uses less CPU resources anyway). Continuing to argue this point is beyond the scope of this discussion. You can research yourself why RSA-2048 is being deprecated, and everyone who can switch is switching Ed25519. Or maybe the OP will write another blog post better than I can, since nobody listens to me anyway. The point was to get you to switch away from RSA, not continue using it with 4096.
theamk 6y ago
Newer keys, especially ed25519, are very short. This makes working with them much easier. Copy-pasting them to remote machine is more reliable, examining authorized_keys us faster and so on.
- bawolff 6y ago
  That may be true, but just because ed25519 might be better, doesn't mean RSA is a "problem"
  - rakoo 6y ago
    In the field of security, much more than in the rest of technology, age is an important factor of being a problem. SHA1 is merely starting to see attacks that can finally be demonstrated rather than theorized, that still take hundreds of CPU-year, 20 years after its inception. But we haven't waited all that time to retire SHA-1, because we know that eventually all schemes fail. Same holds for RSA.
    - bawolff 6y ago
      Are there attacks on RSA with appropriate key sizes? We replaced SHA-1 because the attacks, even if just theoretical, were clearly on the horizon (and we replaced with sha-256 which is basically the same thing with a few tweaks and some parameters increased). RSA certainly has attacks, but they have been compensated with bigger key sizes. Is there any reason to suspect that 4096 bit RSA will be unsafe anytime soon, other than quantum computers? Disclaimer: Iana cryptographer
- nullc 6y ago
  > copy-pasting them to remote machine is more reliable, This has basically nothing to do with the underlying cryptosystem. Instead of explicitly configuring RSA keys, SSH could have been setup where you put their SHA256 hash in the authorized key file. (The pubkey itself would sent by the user at auth time and checked against its hash)

Check out the paper "Ron was wrong, Whit is right" for a survey of keys found on the web and the surprising number of RSA keys that have weaknesses.

throw0101a 6y ago
Discussion of said paper (2012): * https://news.ycombinator.com/item?id=3591429 https://news.ycombinator.com/item?id=3591429
phkahler 6y ago
Why do RSA keys have weaknesses? Wasn't the company found to be compromised and selling products that make weak keys or something like that?
- rcxdude 6y ago
  completely different. RSA group != RSA the algorithm (though they were created by the same people initially).
  - phkahler 6y ago
    I may have been thinking of this: https://www.google.com/amp/s/mobile.reuters.com/article/amp/idUSBRE9BJ1C220131220 https://www.google.com/amp/s/mobile.reuters.com/article/amp/...

genr8 6y ago

There is a good reason, its just buried in complex crypto math and I won't be the one to explain it for you. If you are still using RSA, you should have upgraded to 4096 bit RSA by now. If not, you should be regenerating and changing your keys and not using one 5 or 10 year old 2048-bit RSA key because "2048 should be enough for anyone" and not thinking "I reused this key all over the place and im lazy and i'm sentimental and don't like change". People's key practices are just as bad as their password practices. His personal blog post was not meant to be a comprehensive lesson. But you can do what you want. If this is the first time you're hearing about RSA starting to be phased out, and the new Ed25519, look into it. Or click this if you're lazy. https://medium.com/risan/upgrade-your-ssh-key-to-ed25519-c6e8d60d3c54 https://medium.com/risan/upgrade-your-ssh-key-to-ed25519-c6e... Also of note, is Ed25519 does not harden itself with additional "bits" in the normal RSA sense, it relies on "rounds" of KDF to apply more brute-force protection to the passphrase (you did set a passphrase on your key right?). I would suggest using the -a option with 1000 or more rounds. If you pick 50,000 rounds you might be waiting 5 minutes to log in though. Also of note, ECDSA (the other one) has had curve trust concerns due to NIST possibly being subverted by the NSA. You can read for days on this, but bottom line is we've all agreed to move on. https://security.stackexchange.com/a/227771 https://security.stackexchange.com/a/227771 / https://safecurves.cr.yp.to/ https://safecurves.cr.yp.to/

LeoPanthera 6y ago
Can you please provide a citation for 2048-bit RSA not being enough? That is counter to apparently reliable advice elsewhere.
- genr8 6y ago
  I didnt say it wasn't enough. I said you should upgrade to elliptic curve crypto, or if you have to stay on RSA, re-generate with 4096 because it's better. A 2048 bit RSA key only provides 112 bits of security - claimed to be suitable until the year 2030. RSA-2048 is still techncially ALLOWED by NIST, but that is the literal cutoff mark, below which is disallowed. The spec dates back to 2012 with "NIST Special Publication 800-57 Part1". This specification is up to Revision 5 now, the most recent of which is named "NIST Special Publication 800-57 Part 1 rev 5" published May 2020. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S... . There is no new news regarding the 2048 length since 2012. This estimate also does not factor in CLASSIFIED quantum cryptography thats hidden from the public. I personally don't trust them after the Snowden documents either. Plenty of sites are still using 2048 for compatibility and speed, but if you are re-generating your key now, its advised to upgrade to elliptic curve, or if you must stick on RSA, 3072 or 4096, because 2048 is the literal cutoff point. This document also describes the migration process. NIST SP 800-131A Rev. 2 - Transitioning the Use of Cryptographic Algorithms and Key Lengths https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/...
  - LeoPanthera 6y ago
    The GPG documentation specifically says that 4096 is not "better". https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa4096 https://www.gnupg.org/faq/gnupg-faq.html#no_default_of_rsa40...
    - genr8 6y ago
      4096 _does_ take a lot of extra CPU resources, and it _is_ diminishing returns. But anyone who prioritizes this above all else is arguing either from a vantage point of distributed scaling across servers that cost money to handle millions of extra cycles per key times millions of keys, or from a place of defending the status quo just for the sake of defending their past choices, which I hate. Their motives for defending it have to be questioned. The page says you gain very little, because by this point we are moving away from RSA to elliptic curves, from which you gain A LOT. Section 11.5 states: "If you need more security than RSA-2048 offers, the way to go would be to switch to elliptical curve cryptography — not to continue using RSA." This is the entire point of this HN Thread. A lot of smartcard and hardware vendors have a vested interest in the status quo 2048-bit RSA because they are stingy with embedded CPU resources or monetary resources in the cost of switching algos. And theres specifically an issue with GNUPG and Elliptic Curves and license compatibility https://www.yubico.com/blog/big-debate-2048-4096-yubicos-stand/ https://www.yubico.com/blog/big-debate-2048-4096-yubicos-sta... If you are an end-user with personal keys only, and fast computers, switching to a 3072 or 4096 bit key is a no brainer. The largest overhead of additional CPU cycles is only consumed on generation, not on verification. Interoperability is nearly always ensured, and you gain some 16% percent security (which is NOT "almost nothing"). Beyond that, you should switch to Ed25519 (which uses less CPU resources anyway). Continuing to argue this point is beyond the scope of this discussion. You can research yourself why RSA-2048 is being deprecated, and everyone who can switch is switching Ed25519. Or maybe the OP will write another blog post better than I can, since nobody listens to me anyway. The point was to get you to switch away from RSA, not continue using it with 4096.

theamk 6y ago

Newer keys, especially ed25519, are very short. This makes working with them much easier. Copy-pasting them to remote machine is more reliable, examining authorized_keys us faster and so on.

bawolff 6y ago
That may be true, but just because ed25519 might be better, doesn't mean RSA is a "problem"
- rakoo 6y ago
  In the field of security, much more than in the rest of technology, age is an important factor of being a problem. SHA1 is merely starting to see attacks that can finally be demonstrated rather than theorized, that still take hundreds of CPU-year, 20 years after its inception. But we haven't waited all that time to retire SHA-1, because we know that eventually all schemes fail. Same holds for RSA.
  - bawolff 6y ago
    Are there attacks on RSA with appropriate key sizes? We replaced SHA-1 because the attacks, even if just theoretical, were clearly on the horizon (and we replaced with sha-256 which is basically the same thing with a few tweaks and some parameters increased). RSA certainly has attacks, but they have been compensated with bigger key sizes. Is there any reason to suspect that 4096 bit RSA will be unsafe anytime soon, other than quantum computers? Disclaimer: Iana cryptographer
nullc 6y ago
> copy-pasting them to remote machine is more reliable, This has basically nothing to do with the underlying cryptosystem. Instead of explicitly configuring RSA keys, SSH could have been setup where you put their SHA256 hash in the authorized key file. (The pubkey itself would sent by the user at auth time and checked against its hash)