3 ms·

By cryptography being deployed today I meant new protocols. Like if the people who are actually in the position of picking cryptographic primitives, virtually n

By cryptography being deployed today I meant new protocols. Like if the people who are actually in the position of picking cryptographic primitives, virtually no one reaches for RSA. Sorry if that wasn’t clear.

upofadown 5y ago
To be clear, there is no rational reason not to reach for RSA unless you need the smaller keys of elliptic curves or you are afraid of quantum cryptography and have to avoid elliptic curves as well.
- tptacek 5y ago
  This is comically false. But for the weird appeal to quantum computers, it's exactly what a Slashdot commenter would have said about elliptic curves in 1998.
- garmaine 5y ago
  There is a massive performance difference—not just size, but computation as well. Especially if you want a constant-time implementation. There is also an order of magnitude more ways to screw up and not do input validation correctly, thereby introducing vulnerabilities. For all these reasons there aren’t really good libraries for RSA outside of TLS implementations, and that’s a lot of baggage to inherit if you are not doing TLS.
  - upofadown 5y ago
    RSA is faster for signature generation. RSA is faster by more than an order of magnitude for signature verification[1] and encryption[2]. All these libraries listed here are bad in some way for RSA? * https://en.wikipedia.org/wiki/Comparison_of_cryptography_libraries#Public_key_algorithms https://en.wikipedia.org/wiki/Comparison_of_cryptography_lib... [1] https://www.ijser.org/researchpaper/Performance-Based-Comparison-Study-of-RSA-and-Elliptic-Curve-Cryptography.pdf https://www.ijser.org/researchpaper/Performance-Based-Compar... [2] https://hal.archives-ouvertes.fr/hal-02926106/document https://hal.archives-ouvertes.fr/hal-02926106/document
    - garmaine 5y ago
      Your own link [2] shows RSA being 10-50x slower than the EC algo they used, which itself is many factors slower than state of the art. Are you reading the table right?
      - upofadown 5y ago
        Table 3 (decryption) from link [2] shows that it took 1.265 seconds for 233 bit ECC and 0.031 seconds for 2240 bit RSA to encrypt something. The associated comment was: >We noted that the encryption by the RSA algorithm is faster than the one with ECC algorithm. While we are here, I will point out that the performance was almost the same for the same key lengths in the encryption case. So ECC seems to be faster for key generation but overall slower for everything else.
        marcan_42 5y ago
        Those numbers are clearly nonsense; notice how the smaller ones don't even scale with key size, while they obviously should to some extent. That paper is flawed. They obviously made a mistake. Look at the ed25519 benchmarks: https://ed25519.cr.yp.to/ https://ed25519.cr.yp.to/ 71000 signature verifications per second and 109000 signature generations per second on a quad-core machine. That is much, much faster than RSA. It's well established that ECC is much faster than RSA in general. I suspect I know what happened. DSA signature schemes require randomness to generate signatures, unlike RSA. They probably were using an entropy-constrained random number generator. That bottlenecked ECDSA through no fault of the algorithm. Ed25519 does not suffer from this issue, since it is constructed in a way that requires no external source of randomness (the random part is substituted with a deterministic hash of the key and input).
        upofadown 5y ago
        If you want to prove that ed25519 is generally faster than RSA for signatures I think you would have to find a benchmark that supports your contention.

upofadown 5y ago

To be clear, there is no rational reason not to reach for RSA unless you need the smaller keys of elliptic curves or you are afraid of quantum cryptography and have to avoid elliptic curves as well.

tptacek 5y ago
This is comically false. But for the weird appeal to quantum computers, it's exactly what a Slashdot commenter would have said about elliptic curves in 1998.
garmaine 5y ago
There is a massive performance difference—not just size, but computation as well. Especially if you want a constant-time implementation. There is also an order of magnitude more ways to screw up and not do input validation correctly, thereby introducing vulnerabilities. For all these reasons there aren’t really good libraries for RSA outside of TLS implementations, and that’s a lot of baggage to inherit if you are not doing TLS.
- upofadown 5y ago
  RSA is faster for signature generation. RSA is faster by more than an order of magnitude for signature verification[1] and encryption[2]. All these libraries listed here are bad in some way for RSA? * https://en.wikipedia.org/wiki/Comparison_of_cryptography_libraries#Public_key_algorithms https://en.wikipedia.org/wiki/Comparison_of_cryptography_lib... [1] https://www.ijser.org/researchpaper/Performance-Based-Comparison-Study-of-RSA-and-Elliptic-Curve-Cryptography.pdf https://www.ijser.org/researchpaper/Performance-Based-Compar... [2] https://hal.archives-ouvertes.fr/hal-02926106/document https://hal.archives-ouvertes.fr/hal-02926106/document
  - garmaine 5y ago
    Your own link [2] shows RSA being 10-50x slower than the EC algo they used, which itself is many factors slower than state of the art. Are you reading the table right?
    - upofadown 5y ago
      Table 3 (decryption) from link [2] shows that it took 1.265 seconds for 233 bit ECC and 0.031 seconds for 2240 bit RSA to encrypt something. The associated comment was: >We noted that the encryption by the RSA algorithm is faster than the one with ECC algorithm. While we are here, I will point out that the performance was almost the same for the same key lengths in the encryption case. So ECC seems to be faster for key generation but overall slower for everything else.
      - marcan_42 5y ago
        Those numbers are clearly nonsense; notice how the smaller ones don't even scale with key size, while they obviously should to some extent. That paper is flawed. They obviously made a mistake. Look at the ed25519 benchmarks: https://ed25519.cr.yp.to/ https://ed25519.cr.yp.to/ 71000 signature verifications per second and 109000 signature generations per second on a quad-core machine. That is much, much faster than RSA. It's well established that ECC is much faster than RSA in general. I suspect I know what happened. DSA signature schemes require randomness to generate signatures, unlike RSA. They probably were using an entropy-constrained random number generator. That bottlenecked ECDSA through no fault of the algorithm. Ed25519 does not suffer from this issue, since it is constructed in a way that requires no external source of randomness (the random part is substituted with a deterministic hash of the key and input).
        upofadown 5y ago
        If you want to prove that ed25519 is generally faster than RSA for signatures I think you would have to find a benchmark that supports your contention.