626
Mathematician warns US spies may be weakening next-gen encryption
(www.newscientist.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 13 Oct 2023
626 points (98.8% liked)
Technology
58133 readers
4490 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
Yeah you can observe this with letsencrypt failing to generate a certificate if you change the elliptic curve from an NSA generated curve to a generic/known safe one. Changing between different NSA curves are functionally fine. Forces all signed certificates to use curves that are known to have issues, deliberate or otherwise - i.e. backdoored.
Can you elaborate on this? Which curves does it happen with? Is there some source that you’ve seen?
https://aussie.zone/comment/3519526
You can't use arbitrary curves with certificates, only those which are standardized because the CA will not implement anything which isn't unambiguously defined in a standard with support by clients.
https://community.letsencrypt.org/t/tls-1-2-and-tls-1-3-need-curve25519-and-curve448-ssl-certificates/200775/3
My point is that there is a documented listed of supported curves for ECDSA but attempting to use any other safe curve in the list results in a failure. I am not trying to use some arbitrary curve.
If your point is that no safe curve is permitted because the powers that be don't permit it, TLS is doomed.
https://eff-certbot.readthedocs.io/en/latest/using.html#using-ecdsa-keys
The default is a curve widely believed to be unsafe, p256, with no functioning safe alternative.
https://safecurves.cr.yp.to/
That's Bernstein's website if anyone was wondering, showing p256 is unsafe.
I run a cryptography forum, I know this stuff, and the problem isn't algorithmic weakness but complexity of implementation.
All major browsers and similar networking libraries now have safe implementations after experts have taken great care to handle the edge cases.
It's not a fault with let's encrypt. If they allowed nonstandard curves then almost nothing would be compatible with it, even the libraries which technically have the code for it because anything not in the TLS spec is disabled.
https://security.stackexchange.com/questions/42088/can-custom-elliptic-curves-be-used-in-common-tls-implementations
https://cabforum.org/baseline-requirements-certificate-contents/
CAB is the consortium of Certificate Authorities (TLS x509 certificate issuers)
With that said curve25519 is on its way into the standards
Tldr would be that there are no safe ECC curves in TLS? Yet
P256 isn't known to be insecure if implemented right, it's just harder to implement right
The WRC deals with unsafe curves all the time. I think picking a couple of spots on some of their curves at high speed would be interesting. Samir has been known to break some of these...
That's worrying if true. However I couldn't find a source. Even if true Let's encrypt is probably the most secure option
https://aussie.zone/comment/3519526
Thanks, I am extremely skeptical and I might just reach out to let's encrypt for clarification