Hacker News Reader

Comment by iwwr | Hacker News Reader

So right now, what are recommended public key, cyphers and hash functions for reasonable crypto safety? What about safe crypto pRNG's?

The ubuntu's gpg lists the following:

    Pubkey: RSA, RSA-E, RSA-S, ELG-E, DSA
    Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256
    Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224

View on HN

For starters, please refer to https://wiki.mozilla.org/Security/Server_Side_TLS. For SSH, I lack clear, good advice. I've tended to disable weaker ciphersuites using Mozilla's TLS configuration advice as a guide, and I've also tended to use larger key sizes than the defaults. As questionable as NIST's guidelines have been lately, I tend to follow the high end of their recommended key sizes, so 4096-byte public keys, etc.

This was some recent advice for SSH: https://stribika.github.io/2015/01/04/secure-secure-shell.ht...

It was on discussed on HN, at the time noone pointed out anything glaring about the advice given.

That's a nice link, thanks. I like the writing style. Clear advice, with explanations, not too wordy.

Do you have a pointer to the HN discussion?

It was discussed here: https://news.ycombinator.com/item?id=8843994

Thanks for the links!

Re: PRNG

Fortuna is built on top of an underlying block cipher in counter mode (typically AES), with some additional machinery for periodic reseeding to recover from the situation where the PRNG's internal state is compromised at a particular point in time.

But in most cases, the correct answer is to use your OS's /dev/urandom (CryptGenRandom on windows). If that is not secure your app is probably screwed whatever you do.

GPG's defaults are designed around compatibility. Some older clients require IDEA. Today, There's really no reason to not be using AES or SHA => 256.

Well definitely don't use MD5. And SHA1 and RIPEMD160 are too short to be considered fully collision resistant.

Reply on news.ycombinator.com