4 ms·

Since this article comes up from time to time in a PGP context I generated a PGP FAN article discussing it: * https://articles.59.ca/doku.php?id=pgpfan:rsabad

Since this article comes up from time to time in a PGP context I generated a PGP FAN article discussing it: * https://articles.59.ca/doku.php?id=pgpfan:rsabad https://articles.59.ca/doku.php?id=pgpfan:rsabad A generally relevant excerpt: The writer ends with a discussion of alternatives to RSA. The writer says this: > … the math behind ECC is so complicated that very few people feel confident enough to actually implement it. In other words, it intimidates people into using libraries built by cryptographers who know what they’re doing. RSA on the other hand is so simple that it can be (poorly) implemented in an hour. In other words; the ECC encryption method is superior because it is significantly more complex than RSA. That is at the end of an article that talks about how hard RSA is to get right. This is not a compelling argument.

jcranmer 6y ago
Wow, what a compelling rebuttal of the original article this is! </sarcasm> > The writer mostly talks about common implementation errors. PGP has been using RSA for a very long time now. There is no real chance that there are any of those errors in the PGP code. The opening sections of the article are about how choosing the primes and exponents in RSA is fraught with error. PGP doesn't prescribe any particularly algorithm for these operations, so PGP implementations are potentially susceptible to these issues. > The writer has a section on padding oracle attacks. Such attacks are not applicable to PGP simply because the encryption is only done once and there is no reverse channel. Wow. Just wow. There is actually quite a few ways to get reverse channels out of email, some that don't even require social engineering. The most trivial one is the 1×1 tracking pixel that phones home, which is pretty common in email for tracking purposes. Sorry, this is the kind of rebuttal that proves the actual point of cryptographers: designing cryptosystems is fraught with error, and amateurs are likely to fall into traps they didn't know about. PGP is already decently well-known as being a bad cryptosystem; it's basically a message format that wraps Enc(x) and Sign(x) for your given cryptographic algorithm, and we've spent the last several decades learning that these primitives are not secure by themselves and do not naïvely compose.
- upofadown 6y ago
  >...PGP doesn't prescribe any particularly algorithm for these operations, so PGP implementations are potentially susceptible to these issues. OpenPGP and implementations get a fair bit of academic scrutiny. The published PGP standard refers to RFC3447 which is PKCS #1 v2.1 for RSA. It is quite unlikely that there are any bonehead errors in any of the popular implementations. >The most trivial one is the 1×1 tracking pixel that phones home, which is pretty common in email for tracking purposes. I think it was clear from context that I did not mean that no reverse channels existing anywhere, only in a form suitable for oracle attacks. The HTML image thing is a straight up leak that has actually been used to exfiltrate decrypted plaintext. >PGP is already decently well-known as being a bad cryptosystem... That isn't really true. It is actually one of the solidest cryptographic protocols ever. >...do not naïvely compose. What does that mean?
  - tptacek 6y ago
    There are bonehead errors in PGP, which is not actually one of the solidest cryptographic protocols ever.

jcranmer 6y ago

Wow, what a compelling rebuttal of the original article this is! </sarcasm> > The writer mostly talks about common implementation errors. PGP has been using RSA for a very long time now. There is no real chance that there are any of those errors in the PGP code. The opening sections of the article are about how choosing the primes and exponents in RSA is fraught with error. PGP doesn't prescribe any particularly algorithm for these operations, so PGP implementations are potentially susceptible to these issues. > The writer has a section on padding oracle attacks. Such attacks are not applicable to PGP simply because the encryption is only done once and there is no reverse channel. Wow. Just wow. There is actually quite a few ways to get reverse channels out of email, some that don't even require social engineering. The most trivial one is the 1×1 tracking pixel that phones home, which is pretty common in email for tracking purposes. Sorry, this is the kind of rebuttal that proves the actual point of cryptographers: designing cryptosystems is fraught with error, and amateurs are likely to fall into traps they didn't know about. PGP is already decently well-known as being a bad cryptosystem; it's basically a message format that wraps Enc(x) and Sign(x) for your given cryptographic algorithm, and we've spent the last several decades learning that these primitives are not secure by themselves and do not naïvely compose.

upofadown 6y ago
>...PGP doesn't prescribe any particularly algorithm for these operations, so PGP implementations are potentially susceptible to these issues. OpenPGP and implementations get a fair bit of academic scrutiny. The published PGP standard refers to RFC3447 which is PKCS #1 v2.1 for RSA. It is quite unlikely that there are any bonehead errors in any of the popular implementations. >The most trivial one is the 1×1 tracking pixel that phones home, which is pretty common in email for tracking purposes. I think it was clear from context that I did not mean that no reverse channels existing anywhere, only in a form suitable for oracle attacks. The HTML image thing is a straight up leak that has actually been used to exfiltrate decrypted plaintext. >PGP is already decently well-known as being a bad cryptosystem... That isn't really true. It is actually one of the solidest cryptographic protocols ever. >...do not naïvely compose. What does that mean?
- tptacek 6y ago
  There are bonehead errors in PGP, which is not actually one of the solidest cryptographic protocols ever.