3 ms·

> (kex) ecdh-sha2-nistp521 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency That

by yread 3y ago

> (kex) ecdh-sha2-nistp521 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency That seems a bit paranoid

egberts1 3y ago
[flagged]
- tptacek 3y ago
  What's "often breakable since 2011"?
  - ctz 3y ago
    I think the GP has read but not comprehended the "best public cryptanalysis" part of that page.
tptacek 3y ago
It is that.
- jms703 3y ago
  Backdoored or paranoid?
  - AlexCoventry 3y ago
    Paranoid (based on listening to his recent podcast.)
kbknapp 3y ago
The "Security. Cryptography. Whatever." podcast just did an episode about the origin of the nistp curves. https://securitycryptographywhatever.com/2023/10/12/the-nist-curves/ https://securitycryptographywhatever.com/2023/10/12/the-nist...
deleted 3y ago
[deleted]
candiddevmike 3y ago
There's really no reason to use anything besides Ed25519 these days (openssh has supported it since 2014!). As a bonus, the keys are really short too.
- devman0 3y ago
  Per FIPS 186-5 and SP 800-186, Ed25519 looks like its going to be in next revision of FIPS 140 which will be nice for those who have to stay aligned with FIPS. Hoping that X25519 will come in for KEX as well, but I'm not holding my breath.
- mike_hock 3y ago
  But if the NSA had backdoored that and you were working for the NSA, that's exactly what you would say. What if the NSA wants to get people off elliptic curves because it's the other stuff that they can crack?
  - lazide 3y ago
    Ed25519 is a DJB thing and the suggestion to replace it. If they got to DJB, there is nothing we can do except nuke ourselves pre-emptively!
- Grimburger 3y ago
  Azure doesn't allow Ed25519. AWS only just enabled it in the last year or two.
- Already__Taken 3y ago
  I set up some go cluster app with ed25519 signed x509 certs and it simply wouldn't connect with itself until it made RSA certs :shrug:
- mkj 3y ago
  Does Apple's secure enclave thing support ed25519 now? I think that was missing support a while ago, probably other hardware too. Webcrypto had missing support in some browsers too (though that was rsa-only on firefox for a while, unsure if ed25519 was added)
deleted 3y ago
[deleted]
rurban 3y ago
No. And add the new kyber exchanges also.

by yread 3y ago

> (kex) ecdh-sha2-nistp521 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency That seems a bit paranoid

egberts1 3y ago

[flagged]

tptacek 3y ago
What's "often breakable since 2011"?
- ctz 3y ago
  I think the GP has read but not comprehended the "best public cryptanalysis" part of that page.

tptacek 3y ago

It is that.

jms703 3y ago
Backdoored or paranoid?
- AlexCoventry 3y ago
  Paranoid (based on listening to his recent podcast.)

kbknapp 3y ago

The "Security. Cryptography. Whatever." podcast just did an episode about the origin of the nistp curves. https://securitycryptographywhatever.com/2023/10/12/the-nist-curves/ https://securitycryptographywhatever.com/2023/10/12/the-nist...

deleted 3y ago

[deleted]

candiddevmike 3y ago

There's really no reason to use anything besides Ed25519 these days (openssh has supported it since 2014!). As a bonus, the keys are really short too.

devman0 3y ago
Per FIPS 186-5 and SP 800-186, Ed25519 looks like its going to be in next revision of FIPS 140 which will be nice for those who have to stay aligned with FIPS. Hoping that X25519 will come in for KEX as well, but I'm not holding my breath.
mike_hock 3y ago
But if the NSA had backdoored that and you were working for the NSA, that's exactly what you would say. What if the NSA wants to get people off elliptic curves because it's the other stuff that they can crack?
- lazide 3y ago
  Ed25519 is a DJB thing and the suggestion to replace it. If they got to DJB, there is nothing we can do except nuke ourselves pre-emptively!
Grimburger 3y ago
Azure doesn't allow Ed25519. AWS only just enabled it in the last year or two.
Already__Taken 3y ago
I set up some go cluster app with ed25519 signed x509 certs and it simply wouldn't connect with itself until it made RSA certs :shrug:
mkj 3y ago
Does Apple's secure enclave thing support ed25519 now? I think that was missing support a while ago, probably other hardware too. Webcrypto had missing support in some browsers too (though that was rsa-only on firefox for a while, unsure if ed25519 was added)

deleted 3y ago

[deleted]

rurban 3y ago

No. And add the new kyber exchanges also.