3 ms·
I'm not sure I agree with that. One thing to keep in mind is that SSH uses RSA only for signatures. That already kills off most attacks on RSA, as encryption h
by hannob 5y ago
I'm not sure I agree with that.
One thing to keep in mind is that SSH uses RSA only for signatures. That already kills off most attacks on RSA, as encryption has always been weaker than signatures. Not using a small exponent key kills the most significant attack on signatures.
Regarding sidechannels, the biggest issue I can think of is that ideally you should have constant time modular arithmetic, but you need that for ed25519 as well.
Not necessarily advocating for RSA (ed25519 is fine I guess), but I feel the "RSA is bad" talking point has been overused.
- mananaysiempre 5y agoFrom when I last looked, my impression was that the specific modular arithmetic you need for ed25519 is basically standard long arithmetic with a constant number of digits + a single CMOV, which is different from essentially arbitrary moduli that (reasonably compatible) RSA needs.