Re:Minerva: Practically exploitable side-channel leakage in ...
by xnyan on Thursday October 03, 2019 @01:20PM
(#21149402)
There’s no reason I’m aware of to use ECDSA over other available crypto. Don’t use ECDSA.
[ Parent
| on HN ]
Re:Minerva: Practically exploitable side-channel leakage in ...
by wolf550e on Thursday October 03, 2019 @01:35PM
(#21149598)
1. They show libgcrypt managed to have the bug in EdDSA (https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=c...).
2. People need to use ECDSA for same reason they need to use RSA: compatibility. In particular, EdDSA webpki certificates will likely never happen (https://cabforum.org/pipermail/servercert-wg/2019-June/00087...).
Re:Minerva: Practically exploitable side-channel leakage in ...
by tptacek on Thursday October 03, 2019 @01:37PM
(#21149630)
But, if you fear and loathe ECDSA (and I do as well), it's probably a good idea to get in early against protocols that seek to deploy more of it. For instance, DNSSEC, which is barely deployed anywhere on the Internet, is just now (as in, resolvers couldn't reliably verify ECC records until recently) introducing ECC support --- with ECDSA.
Re:Minerva: Practically exploitable side-channel leakage in ...
by wolf550e on Thursday October 03, 2019 @01:41PM
(#21149672)
I think EdDSA desperately needs to be allowed in FIPS certified hardware, so that secure hardware will have support for EdDSA so that people who have to store keys in secure hardware will be able to use it. I mean HSMs, smart cards, secure enclaves, TPMs, things with a ATECC508A, etc.
Re:Minerva: Practically exploitable side-channel leakage in ...
by wolf550e on Friday October 04, 2019 @01:26PM
(#21159865)
Can downvoters explain why I'm wrong?
Re:Minerva: Practically exploitable side-channel leakage in ...
by loeg on Thursday October 03, 2019 @02:56PM
(#21150681)
There's no reason I'm aware of to use libgcrypt over other available crypto. Don't use libgcrypt.
Re:Minerva: Practically exploitable side-channel leakage in ...
by tptacek on Thursday October 03, 2019 @01:24PM
(#21149467)
This impacts EdDSA as well, the Edwards-curve Schnorr-based system that is a gold standard for signing crypto. While I agree that you should avoid ECDSA, implementation errors can happen to anything.