4 ms·

> The better alternatives include: > ... > The RFC8709 ssh-ed25519 signature algorithm. It has been supported in OpenSSH since release 6.5. As an added bonus

> The better alternatives include: > ... > The RFC8709 ssh-ed25519 signature algorithm. It has been supported in OpenSSH since release 6.5. As an added bonus, in addition to increased security, because the ssh-edd25519 keys are so much shorter, it is much easier to use to cut and paste keys from the command line to a web page for ssh access (ie Github).

encryptluks2 6y ago
I remember working for a large Fortune 500 company and trying to get them to to let me use ed25519 instead of the RSA-1024 standard they had. Because they didn't know what ed25519 was and their security "expert" had told them RSA-1024 was the best, they said no way that they were already using the most secure algorithm.
- loeg 6y ago
  Last time I checked (maybe 2019 or 2020), FIPS only permitted RSA for public-key cryptography. 1024-bit keys were no longer permitted, IIRC. If the company was involved in business with the USG (and many large companies are), they may have needed to comply with FIPS in some way (pure speculation). (Or the recommendation may have been on that basis, even if FIPS/USG was not involved in the ssh use.)
  - vlovich123 6y ago
    On the whole, does FIPS improve security or is it one of those compliance checkboxes that actually reduces security of those who know what they’re doing?
    - er4hn 6y ago
      FIPS 140 provides a standard for assuring that a product has implemented their crypto correctly. It has its warts but overall it skews very close to otuer published sources of algorithms. I think the biggest differences lie in handling edge cases and key generation. That said, receiving a FIPS certification is a huge effort in terms of time and money. I think it is tragic that neither NIST nor the NSA provide a already certified library you can integrate in. That would save enormous amounts of effort. Fun fact - lots of FIPS certifications are white labeled openssl with the latest set of FIPS requirements so I'm not even being that radical.
    - x3n0ph3n3 6y ago
      It's often a requirement for any Federal customers. It's a mixed bag in terms of security, since it does force you off of _very bad_ algorithms, but it doesn't always support the best algorithms.
  - er4hn 6y ago
    FIPS does permit elliptic curves, but only a subset of the NIST ones. So ed25519 and the other djb algorithms are not allowed
    - pquerna 6y ago
      there are ongoing changes to allow ed25519, eg, see: https://csrc.nist.gov/publications/detail/fips/186/5/draft https://csrc.nist.gov/publications/detail/fips/186/5/draft

encryptluks2 6y ago

I remember working for a large Fortune 500 company and trying to get them to to let me use ed25519 instead of the RSA-1024 standard they had. Because they didn't know what ed25519 was and their security "expert" had told them RSA-1024 was the best, they said no way that they were already using the most secure algorithm.

loeg 6y ago
Last time I checked (maybe 2019 or 2020), FIPS only permitted RSA for public-key cryptography. 1024-bit keys were no longer permitted, IIRC. If the company was involved in business with the USG (and many large companies are), they may have needed to comply with FIPS in some way (pure speculation). (Or the recommendation may have been on that basis, even if FIPS/USG was not involved in the ssh use.)
- vlovich123 6y ago
  On the whole, does FIPS improve security or is it one of those compliance checkboxes that actually reduces security of those who know what they’re doing?
  - er4hn 6y ago
    FIPS 140 provides a standard for assuring that a product has implemented their crypto correctly. It has its warts but overall it skews very close to otuer published sources of algorithms. I think the biggest differences lie in handling edge cases and key generation. That said, receiving a FIPS certification is a huge effort in terms of time and money. I think it is tragic that neither NIST nor the NSA provide a already certified library you can integrate in. That would save enormous amounts of effort. Fun fact - lots of FIPS certifications are white labeled openssl with the latest set of FIPS requirements so I'm not even being that radical.
  - x3n0ph3n3 6y ago
    It's often a requirement for any Federal customers. It's a mixed bag in terms of security, since it does force you off of _very bad_ algorithms, but it doesn't always support the best algorithms.
- er4hn 6y ago
  FIPS does permit elliptic curves, but only a subset of the NIST ones. So ed25519 and the other djb algorithms are not allowed
  - pquerna 6y ago
    there are ongoing changes to allow ed25519, eg, see: https://csrc.nist.gov/publications/detail/fips/186/5/draft https://csrc.nist.gov/publications/detail/fips/186/5/draft