Re:Public-Key Encryption in PHP
by tptacek on Tuesday December 27, 2016 @12:42PM
(#13264573)
There are at two problems with this design principle.
The first is that some crypto primitives, whether you want them to or not, have implicit defaults. For instance, when enciphering data with a block cipher, ECB is an implied default.
More importantly, even if you require options, the characteristics of the different choices can push developers towards insecure implied defaults. Even in a library that forces you to pick a block cipher mode, for instance, developers have a strong tendency to pick ECB because it doesn't require an IV (and very few developers understand the concept of an IV).
I generally think RSA libraries should default to OAEP.
The first is that some crypto primitives, whether you want them to or not, have implicit defaults. For instance, when enciphering data with a block cipher, ECB is an implied default.
More importantly, even if you require options, the characteristics of the different choices can push developers towards insecure implied defaults. Even in a library that forces you to pick a block cipher mode, for instance, developers have a strong tendency to pick ECB because it doesn't require an IV (and very few developers understand the concept of an IV).
I generally think RSA libraries should default to OAEP.