3 ms·
Don't forget to add PFS, Microsoft. And no NIST-corrupted curves, please.
by higherpurpose 13y ago
Don't forget to add PFS, Microsoft. And no NIST-corrupted curves, please.
- tptacek 13y agoIn other words, don't use elliptic curves? And, therefore, don't use forward secrecy? Does current browser support for curves even allow you to set up a "NIST-free" ECDHE TLS server?
- pbsd 13y agoThere's also DHE, which is not "NIST-corrupted" I guess. As far as I know, in theory it should be possible to use the Brainpool curves in TLS, but haven't seen such a thing in actual use.
- tptacek 13y agoRight, but it's also not performant enough at scale. NSS doesn't support the Brainpool curves. OpenSSL does, but no mainstream browser uses it.
- harshreality 13y agoSupport in unreleased versions (openssl 1.0.2) counts as support?
- tptacek 13y agoI guess.
- higherpurpose 13y agoYou're using the same argument RSA used when they decided to just keep Dual EC DRBG, because it was "too late to change", even though they knew it was a backdoor. Granted, I think they are lying and did it on purpose, but even their lie is pretty bad logic. They need to talk to Google, Mozilla and others, and decide on using a new set of safe curves in their browsers. Using a broken one is not a solution.
- tptacek 13y agoIE and IIS never used Dual EC as their CSPRNG. The "NIST corrupted curves" you refer to are, for all intents and purposes, the Internet standard curves. Microsoft could provide a configuration that used only the Brainpool curves, but no browser would be able to talk to them.