RSA is a fragile cryptosystem

Re:RSA is a fragile cryptosystem by lvh on Monday July 08, 2019 @09:50AM (#20382667)

It doesn't need to tell you anything new about prime number factorization because practical RSA cryptosystems get broken with far more boring bugs than prime number factorization. RSA padding bugs aren't really "coding errors": RSA padding is just as critical to RSA security as the hardness of number factoring.

Furthermore, they don't just tell you to use some random curve thing: they tell you to use a specific implementation with knobs twiddled for security. You could work hard to maybe get everything right, or you can just do this thing and everything will be set for safety for you.

[ Parent | on HN ]

Re:RSA is a fragile cryptosystem by mikorym on Monday July 08, 2019 @12:39PM (#20384185)

So, to be Devil's Advocate, does libsodium also provide an RSA implementation?

[ Parent | on HN ]

Re:RSA is a fragile cryptosystem by tabletopneedle on Monday July 08, 2019 @01:42PM (#20384915)

There is no place to use RSA instead of Diffie-Hellman. DH provides forward secrecy, and the ECC variants are much faster and use shorter keys for equivalent security. They are harder to implement in a wrong way.

[ Parent | on HN ]

Re:RSA is a fragile cryptosystem by lvh on Monday July 08, 2019 @01:37PM (#20384843)

No. Why would it?

[ Parent | on HN ]

Re:RSA is a fragile cryptosystem by cryptonector on Tuesday July 09, 2019 @12:33AM (#20389050)

If you only use RSA to sign and not encrypt, then you lose the padding oracle attach and you're left with... a ton of other issues still. But the Bleichenbacher family of attacks is really devastating, so I'd tolerate some RSA digital signature usage. But please, stop using RSA key transport!!

[ Parent | on HN ]