Hacker News Reader

Comment by yread | Hacker News Reader

> (kex) ecdh-sha2-nistp521 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency

That seems a bit paranoid

View on HN

There's really no reason to use anything besides Ed25519 these days (openssh has supported it since 2014!). As a bonus, the keys are really short too.

Per FIPS 186-5 and SP 800-186, Ed25519 looks like its going to be in next revision of FIPS 140 which will be nice for those who have to stay aligned with FIPS. Hoping that X25519 will come in for KEX as well, but I'm not holding my breath.

Azure doesn't allow Ed25519. AWS only just enabled it in the last year or two.

Does Apple's secure enclave thing support ed25519 now? I think that was missing support a while ago, probably other hardware too.

Webcrypto had missing support in some browsers too (though that was rsa-only on firefox for a while, unsure if ed25519 was added)

But if the NSA had backdoored that and you were working for the NSA, that's exactly what you would say. What if the NSA wants to get people off elliptic curves because it's the other stuff that they can crack?

Ed25519 is a DJB thing and the suggestion to replace it.

If they got to DJB, there is nothing we can do except nuke ourselves pre-emptively!

I set up some go cluster app with ed25519 signed x509 certs and it simply wouldn't connect with itself until it made RSA certs :shrug:

The "Security. Cryptography. Whatever." podcast just did an episode about the origin of the nistp curves.

https://securitycryptographywhatever.com/2023/10/12/the-nist...

No. And add the new kyber exchanges also.

It is that.

Backdoored or paranoid?

Paranoid (based on listening to his recent podcast.)

Reply on news.ycombinator.com