Conversation

@soatok _uploadRSAPrivateKey(), woooooooo

1
1
0

@soatok Is it wrong that I didn't get past "a secure chat app" in the post title before I reflexively assumed they utterly fucked up their hand-rolled cryptography protocols?

0
1
0

@soatok It took me a second to see the Telegard thing at the top so initially I thought this was going to be about Telegram.

1
1
0

@soatok I wish i could read the article without signing up on that random website

1
0
0

@ariarhythmic It's not really a random website, it's a tech news website ran by @josephcox and friends.

They do good work. I subscribe to it and even pay, because journalism is important.

0
0
0

@soatok I don't have access to read that fully, but holy shit, it sounds bad, really goddamn bad lol

1
0
0

@ariadne @soatok Also, still using RSA in 2021 and onwards is a bad smell in and of itself, given how easy it is to use it in a vulnerable way.

1
0
0

@soatok @stiiin no. RSA is fine as long as the modulus is sufficient.

the QC advances are overstated: if you read the paper, they chose intentionally weak key parameters to factor, and in any case the modulus was only 22 bits.

this isn't to say that tasteful elliptic curve cryptography (like curve25519) is bad, just that there really isn't any urgency to move away from RSA in systems which use it.

its still a valid choice, as long as there is a sufficiently large modulus. keys with 4096 or 8192 bit modulus are totally fine for the forseeable future for example, bar some major advancement in quantum computing.

but I don't see it happening this decade.

1
0
0

@ariadne @soatok @stiiin yeah but this isn’t a legacy protocol and a CRQC will break ecc all the same

1
0
1

@soatok @stiiin @charlotte sure, they made mistakes. lots of them in fact. I just don't consider using RSA to be a concern here.

0
0
0