News for hackers. Stuff that matters.

A comment on Signing .jars is not worth the effort. Parent comment

Re:Signing .jars is not worth the effort by beefhash on Sunday July 26, 2020 @01:21PM (#23958534)
Out of curiosity:

1. Why ECDSA?

2. Why a 512-bit prime for the curve?

[ Parent | on HN ]
Re:Signing .jars is not worth the effort by Uwqye2134trf on Sunday July 26, 2020 @02:48PM (#23959205)
1. Only two asymmetric algorithms are widely supported and almost universlly recommended, RSA and ECDSA. Compared to RSA, ECC needs smaller keys for same security.

2. I did that couple years ago already, I think it actually was 521 bits, the best one recommanded by FIPS at that time. The hardware has no relations to FIPS, it's not even _that_ expensive and should contain no secret data. I just saw no reasons not to implement the best security available: development time is not affacted by the count of these bits.

[ Parent | on HN ]