Hacker News Reader

Comment by JackSlateur | Hacker News Reader

The world has moved away from RSA etc to elliptic curves. Not everybody did, through. RSA is no longer the standard, and has not been for many years.

View on HN

You can’t imagine how many places I’ve seen “Elliptic curve certificates are not supported” as recently as this year.

It’s the IPv6 of the security world.

That's because certificates are all about authentication not encryption. There is no real reason to move away from RSA for authentication. The reason that TLS moved away from RSA for encryption is that it is awkward to do forward secrecy with RSA due to the slowness of generating new RSA keypairs. In practice you would want to generate a new RSA keypair every, say, hour on the server and then somehow get it down to the cryptography level for use. Totally doable, but a different way of doing things.

Still, plenty of old stuff was scraped/sniffed under the "store now, decrypt later" methodology.

True. The only solution is to keep your data outside cloud(aka someone else's computer) no matter what encryption you use.

Also means it can’t transit the internet. So actually, only on airgapped networks.

If we're going to extremes like that, airgapped networks aren't truly safe either

Also, the safest data is the one never sampled into digital format and stored in computer systems.

Could you explain why that is? If I have an airgapped smart home network, someone has to come physically sniff the packets. If it’s only over ethernet, they have to physically plug in. That’s not a scalable attack strategy.

There's tons of ways to exfiltrate data from air gapped systems, if you can manage to get something installed in them. Ones I've read about are by toggling the caps lock led and recording it with a camera. Encoding data into the cpu fan speed, and capturing the sound with a microphone for analysis (run a spinloop for a 1, thread.sleep for a zero). Variations of these can also be used, such as with screen brightness, monitoring powerlines.

My personal favourite is one where they send specific patterns of data over usb, where the EM fields generated by the "data" flowing over the wire form a carrier signal onto which data can be encoded, which can be received up to 5m away. This requires no additional hardware.

All of these involve some malware installed on the system and have a tiny amount of bandwidth, but if there'a man on the inside, all they have to do is install the malware without having to worry about additional hardware for getting the data out of the machine.

Reply on news.ycombinator.com