4 ms·
ECC is also easy to mess up, especially the NIST curves. Plenty of subtle stuff to get wrong.
by throwaway81523 5y ago
ECC is also easy to mess up, especially the NIST curves. Plenty of subtle stuff to get wrong.
- deleted 5y ago[deleted]
- tptacek 5y agoCurve25519 is significantly harder to mess up than RSA. You can go either way on the NIST curves vs. RSA, but at an architectural level there's simply less that goes around with the model of ECC than with RSA, which directly exposes an easy-to-use (and treacherously easy to fuck up) encryption transform. I wouldn't implement with the NIST curves at all, but if you asked me to pick between them and RSA, I'd still take P-256 over RSA.
- jchw 5y agoThat was acknowledged and accounted for in the original article. But given that we have curves that we believe are safe, I’m not sure this is an issue, at least any more so than relying on known-good ranges for parameters in any cryptosystem…