4 ms·
Would be interested in hearing more detail about your objections to both Poly1305 and ECC.
by drewcrawford 12y ago
Would be interested in hearing more detail about your objections to both Poly1305 and ECC.
- cperciva 12y agoToo many ways to screw things up, not enough decades of cryptographic analysis, and there are simpler tools available which have been around for longer. This is subject to the caveat that ECC offers benefits under certain specific conditions (e.g., you need small signatures or a small ASIC die area); but in those situations you want to talk to a cryptographer anyway. My talk was providing guidelines for software developers who are writing code for general-purpose PC hardware.
- robryk 12y agoWhat are your thoughts on using NaCl? On one hand it gives harder-to-misuse primitives, on the other is uses elliptic curve crypto.
- tptacek 12y agoI'm not sure how anyone can look at OAEP and call RSA "simple". Worse still: very few people will ever implement their own ECC code, but lots of people will use RSA implementations that more or less just expose the RSA primitive and fob "encoding" off on the developer.