3 ms·

RSA has been known to be problematic for a very long time at this point, hopefully it just fades into obscurity soon and we can move on with less error-prone ci

by kpcyrd 3y ago

RSA has been known to be problematic for a very long time at this point, hopefully it just fades into obscurity soon and we can move on with less error-prone ciphers.

cookiengineer 3y ago
> less error-prone ciphers. ...such as? The paper also describes how all programming languages that use BigInt data types are likely to be affected. It also specifically refers to the ECDSA TLS attack from 2015, as well as the Minerva/Raccoon attacks which work in a similar way. As isogeny key exchange algorithms are likely to be all vulnerable after the SIKEp434, SIKEp503, SIKEp610, and SIKEp751 fiasco(s) of last year, I'm curious as to what kind of alternatives you suggest? Honestly, at this point I'd say anyone that makes these kind of claims that there even are "less error-prone ciphers" just hasn't worked long enough in cryptography to have learned otherwise. And I'd be bold to say it's probably all not possible due to how we design the CPU hardware and their memory interactions. Even if it's not the software (and it runs in constant time to prevent analysis) there have been lots of acoustic side channel attacks that were just analyzing the sounds that the transistors on the CPU make. So all your random no-op instructions are kind of useless against that, too. [1] Minerva attack: https://minerva.crocs.fi.muni.cz/ https://minerva.crocs.fi.muni.cz/ [2] Racoon attack against FDDH: https://raccoon-attack.com/ https://raccoon-attack.com/ [3] Key recovery attack on SIDH: https://eprint.iacr.org/2022/975.pdf https://eprint.iacr.org/2022/975.pdf [4] Acoustic recovery of GnuPG (RSA) keys: http://cs.tau.ac.il/~tromer/acoustic/ http://cs.tau.ac.il/~tromer/acoustic/
- pie_flavor 3y ago
  While timing attacks are not one of the ways RSA is more error-prone, it is still more error-prone, particularly regarding client secret selection.
  - coppsilgold 3y ago
    That is only because the way RSA key exchange has been implemented everywhere involves padding. RSA-KEM[1] has been available since forever and no padding is required, though no one uses it for some reason. RSA-KEM is also trivial to implement as it's virtually identical to textbook RSA, with the sole restriction that m has to be randomly sampled from 1 .. n-1. And just like that, no padding oracles. [1] <https://en.wikipedia.org/wiki/Key_encapsulation_mechanism https://en.wikipedia.org/wiki/Key_encapsulation_mechanism> , <https://datatracker.ietf.org/doc/html/rfc5990 https://datatracker.ietf.org/doc/html/rfc5990>
webdoodle 3y ago
> less error-prone ciphers. AKA Intentional backdoors for the NSA.

by kpcyrd 3y ago

RSA has been known to be problematic for a very long time at this point, hopefully it just fades into obscurity soon and we can move on with less error-prone ciphers.

cookiengineer 3y ago

> less error-prone ciphers. ...such as? The paper also describes how all programming languages that use BigInt data types are likely to be affected. It also specifically refers to the ECDSA TLS attack from 2015, as well as the Minerva/Raccoon attacks which work in a similar way. As isogeny key exchange algorithms are likely to be all vulnerable after the SIKEp434, SIKEp503, SIKEp610, and SIKEp751 fiasco(s) of last year, I'm curious as to what kind of alternatives you suggest? Honestly, at this point I'd say anyone that makes these kind of claims that there even are "less error-prone ciphers" just hasn't worked long enough in cryptography to have learned otherwise. And I'd be bold to say it's probably all not possible due to how we design the CPU hardware and their memory interactions. Even if it's not the software (and it runs in constant time to prevent analysis) there have been lots of acoustic side channel attacks that were just analyzing the sounds that the transistors on the CPU make. So all your random no-op instructions are kind of useless against that, too. [1] Minerva attack: https://minerva.crocs.fi.muni.cz/ https://minerva.crocs.fi.muni.cz/ [2] Racoon attack against FDDH: https://raccoon-attack.com/ https://raccoon-attack.com/ [3] Key recovery attack on SIDH: https://eprint.iacr.org/2022/975.pdf https://eprint.iacr.org/2022/975.pdf [4] Acoustic recovery of GnuPG (RSA) keys: http://cs.tau.ac.il/~tromer/acoustic/ http://cs.tau.ac.il/~tromer/acoustic/

pie_flavor 3y ago
While timing attacks are not one of the ways RSA is more error-prone, it is still more error-prone, particularly regarding client secret selection.
- coppsilgold 3y ago
  That is only because the way RSA key exchange has been implemented everywhere involves padding. RSA-KEM[1] has been available since forever and no padding is required, though no one uses it for some reason. RSA-KEM is also trivial to implement as it's virtually identical to textbook RSA, with the sole restriction that m has to be randomly sampled from 1 .. n-1. And just like that, no padding oracles. [1] <https://en.wikipedia.org/wiki/Key_encapsulation_mechanism https://en.wikipedia.org/wiki/Key_encapsulation_mechanism> , <https://datatracker.ietf.org/doc/html/rfc5990 https://datatracker.ietf.org/doc/html/rfc5990>

webdoodle 3y ago

> less error-prone ciphers. AKA Intentional backdoors for the NSA.