5134 entries in 0.983s
decimation: re: rolling dice to generate
RSA keypair << this is not straightforward at all, and in general you are going to end up seeding some kind of RNG to produce your primes to test
mircea_popescu: mdev: the public key argument thing, about it being exposed after the first transaction, not sure why that's an issue,
RSA is based off handing out public keys, I know bitcoin uses ECDMA or whatever, but still if the public key can't be trusted << because cargo cult sekoority.
mdev: if that alg is weak or they're not sure about its reliability why didn't they use a more trustworthy one like
RSA mdev: the public key argument thing, about it being exposed after the first transaction, not sure why that's an issue,
RSA is based off handing out public keys, I know bitcoin uses ECDMA or whatever, but still if the public key can't be trusted
Apocalyptic: mircea, I see, my interpretation of "EC-based keys are just as secure as
RSA keypairs" was different
mircea_popescu: Apocalyptic, the question is more subtle than that. perhaps a better rendering would be "which of
rsa, ec is more likely to have tiny pores we don't kjnow about"
mircea_popescu: mike_c: asciilifeform: do you know if this is true? "EC-based keys are just as secure as
RSA keypairs" << nobody fucking knpows if this is true, this is the mn dollar question in practical cryptography.
decimation: looking at the end-to-end turd, it appears that they do support many ciphers: aes.js aeskeywrap_testdata.js blowfish.js cipher.js ciphertext.js ecdh.js elgamal.js idea.js
rsa.js workerservice.js
decimation: but I suspect the majority of existing GPG keys use
RSA (or maybe elgamal)
decimation: It is interesting that google "dropped support" of
RSA in alpha for "performance reasons"
mike_c: i hate cloudflare as much as everyone, but this is actually a really useful primer on
RSA and EC if you are new to the details of how they work:
mike_c: asciilifeform: do you know if this is true? "EC-based keys are just as secure as
RSA keypairs"
decimation: "Why do you only support Elliptic Curve (EC) key generation? Generating
RSA keypairs is very significantly slower than generating EC-based ones. EC-based keys are just as secure. "
decimation: you should implement
RSA in 74xx series logic
joecool: despite what it says it does support 4096bit
RSA keys with reasonably recent gnupg
benkay: when built and packaged per the nondeterministic build for distribution process, openssl refuses to hilariously generate
rsa keys
BingoBoingo: So... When does bitcoin get
RSA key'd addresses?
ozbot: TLS 1.3 Draft Prepares to Drop Static
RSA Key Exchange - Slashdot
decimation: asciilifeform: I think the
RSA keyfob hack demonstrates your point about yubikey perfectly
mircea_popescu: twitter.com, Twitter, Inc. VeriSign Class 3 Extended Validation SSL CA, VeriSign, Inc. 05/10/2016 12:59:00 AM GMT TLS v1.2 128 bit ARC4 (2048 bit
RSA/SHA)
pankkake: apparently "PGP" is an algorithm. it's next to "
RSA"
mircea_popescu: if someone is going to break your gpg encryption tehy will attack the symmetric key not the 4kb
rsa benkay: so i'm looking at these "ultimate gpg guides", and they all say to create a new signing subkey with
rsa signing only and then delete the secret key. how am i supposed to decrypt without the secret key? is there some other key for en/decryption that gets spun up at the same time?
rithm: -----BEGIN
RSA PRIVATE KEY-----
mircea_popescu: kinda the reason why the
rsa corp is going the way of cisco.
ozbot: Report:
RSA endowed crypto product with second NSA-influenced code | Ars Technica
bounce:
rsa gets impractical quickly on paper, much less mentally. might look into that crypto by pack of cards thing though.
kanzure: asciilifeform: yes i'm sure there's someone, somewhere, doing
rsa in head
mircea_popescu: ;;later tell benkay "the secret discovery of these techniques was for the Tyrant merely a happy accident" << it was in fact.
rsa was invented by some brit guy, kept under lock and key unused for 4 decades.
BingoBoingo: I mean for the first set you could probably encode information much as
RSA does. I don't have enough vodka on hand to speculate if that would be a good idea. Most of Elliptic curve cryptography works on spaces that can be played with in graph theory world though.
mircea_popescu: basically the problems of 1) do what you describe and 2) make a
rsa key are homologous.
joecool: i'm using 4096-bit
RSA for the forseeable future, but ecdsa seems attractive if i can write a javacard implementation to work on my yubikey neo
davout: jurov: phuctor i dunno, but i heard some
RSA keys were found to be weak
davout: still, it sounds that because of the birthday paradox, the more
RSA gets used, the weaker it becomes
davout: dignork: the global search space must be mind-boggling if the PRNG is relied upon to select a search space that won't overlap with other search spaces from other known
RSA keys
davout: because the more know
RSA keys exist, the weaker they collectively become
dignork: davout: if you mean finding primes for
RSA, PRNG is only used to select a search range
davout: and the fact that you can factor
RSA keys if you find two that share a prime makes me wonder whether we won't someday run out of usable ones
cads: asciilifeform: you say that we want the 'opposite' of
rsa (public decrypt, private encrypt), but... this is just the same as giving the public the private key and keeping the public one secret.
decimation: Ascii does an RFID card exist which implements
RSA?
ozbot:
RSA Response to Media Claims Regarding NSA Relationship » Speaking of Security - The
RSA Blog
mod6: (who was really suprised about the
RSA/NSA news anyway?) I don't think there is a single software or hardware producer in the US that trust. Not that I perhaps ever did, but now its all out there!!
mod6: With the news about
RSA/NSA/BSafe and that they put in a backdoored Dual ECC RNG as default in the rolling key fob, I hardly imagine the demand for a trustworthy and open-source producer of cryptographic devices.
ozbot: Reuters:
RSA Weakened Encryption For $10M From NSA - Slashdot
ozbot: NSA paid $10 million to put its backdoor in
RSA encryption, according to Reuters report | The Verge
Duffer1: i wonder if that makes
rsa legally vulnerable to fraud suites
BingoBoingo: asciilifeform: Maybe you linked this, but I recall finding a paper on how SPARC chips can leak
RSA keys given an attacker feeding the system sertain kinds of voltage fluctuations.
mircea_popescu: pankkake earlier linked material, some laughable company sueing people because it thinks it invented
rsa BingoBoingo: asciilifeform: I liken that sort of stuff to the people who support Elliptic curve cryptography because the short keys let minimalist embeded smartcard hardware carry out thousands of operations a second as opposed to hundreds for
RSA with appropriately long keys.
mircea_popescu: if generating the keypair takes two days, encrypting anything in straight
rsa should be interesting.
BingoBoingo: asciilifeform: B&W mac running NetBSD, Trying to create an
RSA key pair of decent size on it.
BingoBoingo: Really...
RSA comes from the era when the NSA diddled algoriths like DES to actually make them stronger... just use long keys.