4 ms·

>Most cryptographers recommend migrating away from RSA. They do? This strikes me as an exceptional statement that smacks of crypto fandom especially when combi

>Most cryptographers recommend migrating away from RSA. They do? This strikes me as an exceptional statement that smacks of crypto fandom especially when combined with a later complaint that their favourite curve is not supported.

holtalanm 5y ago
i have never seen anything anywhere advocating for moving away from RSA. i'm curious to see what their sources are for this claim.
- vbezhenar 5y ago
  https://news.ycombinator.com/item?id=25022845 https://news.ycombinator.com/item?id=25022845 (https://blog.trailofbits.com/2019/07/08/fuck-rsa/ https://blog.trailofbits.com/2019/07/08/fuck-rsa/) for example
  - holtalanm 5y ago
    watched the whole thing. was very informative. Actually havent used RSA in any capacity in years (AES is a lot easier to use), but always viewed RSA as a battle-tested encryption method/alg. I suppose with anything there are ways to misuse it, and RSA appears to be really easy to misuse.
    - noodlesUK 5y ago
      I would say that it’s fairly rare that RSA and AES are really competitors for the same category of uses, as they’re asymmetric and symmetric algorithms respectively. I would suggest that anyone who doesn’t know about the differences between these things just not use cryptography directly and instead use things like libsodium which has sane defaults and a hard to misuse api. If you don’t know cryptography fairly well, it’s a massive minefield.
- jnwatson 5y ago
  In 2005, The NSA began recommended migrating away from RSA and onto ECC algorithms for its customers' classified use cases. [1] In 2018, it paused that recommendation, essentially arguing that if you haven't migrated already, wait until the quantum-resistant algorithms are well vetted to avoid a second migration. 1. [https://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography https://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography]
munchbunny 5y ago
In my experience the recommendation to move away from RSA is only true for building entirely new systems. RSA isn't yet recommended against in the sense that using RSA (with sufficient key length, and avoiding the known footguns) to talk with systems that are too old to understand the newer curves is not considered insecure.
- munchbunny 5y ago
  I know responding to my own comment is taboo, but I wanted to add some more nuance to the statement. I think it's uncontroversial to say that RSA in practice is a fraught proposition. There are a lot of foot-guns that even the mainstream libraries don't protect you from, so just using RSA means you need to spend a lot of time making sure you're not using it the wrong way, and "how to use it right" isn't elegantly contained in a Stack Overflow answer anywhere. And because RSA comes with so many knobs to turn, it ends up being an extensive analysis task for the poor developer whose job is to write the code. I've been that developer. However, if the choice is between (1) using RSA, with caveats, because the tech stack is already mostly RSA, and (2) updating the whole tech stack to ECC based algorithms, we are not yet at the point where option #2 is always the right answer.
paulddraper 5y ago
Primarily, because ECC is more efficient than RSA (which you can use to make it faster or more secure). That's particularly important for wireless devices/IoT. A shakier reason is speculation that prime factorization could be more solvable problem than elliptic curves.
SAI_Peregrinus 5y ago
RSA signatures aren't really an issue. Big, but not that easy to screw up. The (biggest IMO) problem with RSA is that unlike ECDSA or ECDH or EdDSA it's usable for BOTH signing AND encryption, and re-using the same keys for both signing and encryption can be catastrophic (if you screw up the padding, which is another uniquely-RSA footgun). It's far, far easier to have a signing algorithm with signing keys, and an encryption algorithm with encryption keys than it is to have a single algorithm that does everything but requires the user to get all the options right. By working the same "both ways" RSA makes asymmetric key management even harder, and it's already one of the hardest parts of cryptography!

holtalanm 5y ago

i have never seen anything anywhere advocating for moving away from RSA. i'm curious to see what their sources are for this claim.

vbezhenar 5y ago
https://news.ycombinator.com/item?id=25022845 https://news.ycombinator.com/item?id=25022845 (https://blog.trailofbits.com/2019/07/08/fuck-rsa/ https://blog.trailofbits.com/2019/07/08/fuck-rsa/) for example
- holtalanm 5y ago
  watched the whole thing. was very informative. Actually havent used RSA in any capacity in years (AES is a lot easier to use), but always viewed RSA as a battle-tested encryption method/alg. I suppose with anything there are ways to misuse it, and RSA appears to be really easy to misuse.
  - noodlesUK 5y ago
    I would say that it’s fairly rare that RSA and AES are really competitors for the same category of uses, as they’re asymmetric and symmetric algorithms respectively. I would suggest that anyone who doesn’t know about the differences between these things just not use cryptography directly and instead use things like libsodium which has sane defaults and a hard to misuse api. If you don’t know cryptography fairly well, it’s a massive minefield.
jnwatson 5y ago
In 2005, The NSA began recommended migrating away from RSA and onto ECC algorithms for its customers' classified use cases. [1] In 2018, it paused that recommendation, essentially arguing that if you haven't migrated already, wait until the quantum-resistant algorithms are well vetted to avoid a second migration. 1. [https://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography https://en.wikipedia.org/wiki/NSA_Suite_B_Cryptography]

munchbunny 5y ago

In my experience the recommendation to move away from RSA is only true for building entirely new systems. RSA isn't yet recommended against in the sense that using RSA (with sufficient key length, and avoiding the known footguns) to talk with systems that are too old to understand the newer curves is not considered insecure.

munchbunny 5y ago
I know responding to my own comment is taboo, but I wanted to add some more nuance to the statement. I think it's uncontroversial to say that RSA in practice is a fraught proposition. There are a lot of foot-guns that even the mainstream libraries don't protect you from, so just using RSA means you need to spend a lot of time making sure you're not using it the wrong way, and "how to use it right" isn't elegantly contained in a Stack Overflow answer anywhere. And because RSA comes with so many knobs to turn, it ends up being an extensive analysis task for the poor developer whose job is to write the code. I've been that developer. However, if the choice is between (1) using RSA, with caveats, because the tech stack is already mostly RSA, and (2) updating the whole tech stack to ECC based algorithms, we are not yet at the point where option #2 is always the right answer.

paulddraper 5y ago

Primarily, because ECC is more efficient than RSA (which you can use to make it faster or more secure). That's particularly important for wireless devices/IoT. A shakier reason is speculation that prime factorization could be more solvable problem than elliptic curves.

SAI_Peregrinus 5y ago

RSA signatures aren't really an issue. Big, but not that easy to screw up. The (biggest IMO) problem with RSA is that unlike ECDSA or ECDH or EdDSA it's usable for BOTH signing AND encryption, and re-using the same keys for both signing and encryption can be catastrophic (if you screw up the padding, which is another uniquely-RSA footgun). It's far, far easier to have a signing algorithm with signing keys, and an encryption algorithm with encryption keys than it is to have a single algorithm that does everything but requires the user to get all the options right. By working the same "both ways" RSA makes asymmetric key management even harder, and it's already one of the hardest parts of cryptography!