安全与隐私blog.trailofbits.com
RSA 是一种脆弱的密码系统
RSA is a fragile cryptosystem
2019 — 2022，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
Trail of Bits 的这篇博文历数 RSA 在实际使用中的种种脆弱性：填充方案缺陷、私钥指数选取不当、签名攻击等，并建议开发者改用基于椭圆曲线的现代方案（如 Ed25519）。文章语气激烈，在 Hacker News 上多次引发关于“RSA 是否真的该被抛弃”的争论。
为什么经久不衰：它把“RSA 问题出在实现而非算法本身”这一长期争论摆上台面，对今天选择加密原语仍有参考价值。
HN 评论精选
普通开发者读不懂密码学建议，呼吁有一篇面向实践者的“该怎么做”指南
我是开发者不是密码学家，和大多数密码学文章一样，这篇大部分内容对我如同天书。我努力读了个开头就放弃了，直接滚到“该用什么替代”，结果发现那部分也看不懂。如果这就是“简单”的密码学，而我又不该自己造轮子，那我到底该怎么办？“用椭圆曲线但务必选对曲线！libsodium 里有，你没问题了”这种话安慰不了我。我连曲线是什么都没有直觉。如果我调用 libsodium 时传的是自己不理解的参数，那我不还是在变相自己造密码吗？如果我想让客户通过不可信信道给我发加密数据，该怎么做？我需要的是公钥密码版的 Coda Hale 密码哈希经典文章，存在吗？（编辑：感谢大家的评论，Paragonie 那篇 libsodium 快速参考是绝佳起点，我现在比两小时前自信多了。）
skrebbel查看英文原文
I'm a developer, not a cryptographer, and like most crypto articles, most of this post is gibberish to me. I really tried to follow it in the beginning, but then I gave up, scrolled to the "what should you use instead", and then realized I didn't understand that either. If this is article is "easy" crypto, and I shouldn't roll my own crypto, then what should I do? "Just use elliptic curve crypto but make sure you choose the right curve! Here's an abbreviation for you, libsodium has it so you're all set" doesn't comfort me much. I don't have a good intuition of what a curve even is and why my sensitive data can't just go straight ahead like all the other data. I mean, when I call into libsodium with parameters I do not understand, then aren't I, for all intents and purposes, rolling my own crypto anyway? How is any of this of help? If I want to allow my customers to send me encrypted data via an untrusted channel, then what do I do? I need public key crypto for that, right? Basically, I want the public key cryptography version of Coda Hale's classic blog post about password hashing [0], does that exist? EDIT: thanks for all the comments folks, great insights! I particularly found [1] by CiPHPerCoder to be a great starting point (akin to Coda's password article) for all kinds of scenarios. I feel much more confident about this stuff now than I did 2 hours ago. [0] https://codahale.com/how-to-safely-store-a-password/ [1] https://paragonie.com/blog/2017/06/libsodium-quick-reference-quick-comparison-similar-functions-and-which-one-use
密码学专家认为文章列举的攻击不够准确，RSA 实际问题更多
吹毛求疵一下：文中包含一些我认为现实中根本不会发生的攻击（坏的私钥指数大小、Franklin-Reiter），却漏掉了最著名的 RSA 攻击之一——Bleichenbacher 的 e=3 签名攻击，今年刚有一篇优秀的 NDSS 论文讲它。所以我想说：RSA 比这篇博文描述的还要糟糕。
tptacek查看英文原文
Nitpick: This includes some attacks that I don't think really ever occur in the real world (bad private exponent size, Franklin-Reiter) and misses one of the great RSA attacks, Bleichenbacher's "rump session" e=3 signature attack, about which there was an excellent NDSS paper (also being presented at Black Hat) just this year. So I guess I'm saying: RSA is even worse than this blog post suggests. https://www.ndss-symposium.org/wp-content/uploads/2019/02/ndss2019_04A-4_Chau_paper.pdf
问题根源是糟糕的实现而非 RSA 算法本身，换算法解决不了
我一般喜欢 Trail of Bits 的内容，但这种粗口和激烈语气似乎只是为了给一个伪问题博眼球。RSA 算法本身在现实使用中是安全的，我们一直在安全地使用它。真正的问题是：对密码学理解不足导致实践中实现糟糕。这个问题适用于任何算法，不只是 RSA 和 ECC。就算明天所有人都弃用 RSA 改用 ECC，问题就解决了吗？不会。
groovybits查看英文原文
I generally enjoy the content that Trail of Bits puts out, but the harsh tone and use of explatives seems only for the sake of attention to a non-issue. RSA, the algorithm, is generally safe for real-world use. It is possible to use RSA securely (we've been doing it). However, there is indeed an issue. Lets define the issue: Poor understanding of cryptography leads to poor implementation in practice. This issue applies to any crypto algorthim, not just RSA and ECC. If everyone dropped RSA tomorrow in favor of ECC, would all of our problems be solved? No. How to solve this issue? 1. Increase understanding of general cryptography. It is a dense subject. 2. Make implementation of cryptography easier. This is slightly more difficult though, as it depends on your use-case.
对普通用户而言 RSA 和 EdDSA 都是安全可接受的选择，文章言过其实
我不喜欢这篇文章。从安全角度看，RSA 是完全可接受的选择，EdDSA 也一样。它们有不同的权衡，作为用户（比如选 SSH 或 SSL 密钥）而非设计者，你完全可以任选其一。两者都需要选对密钥长度、用经过审查的正确工具，但从安全角度用哪个都没什么坏处。
drivebycomment查看英文原文
I don't like this article. From the security perspective, RSA is a perfectly acceptable choice. EdDSA is good and also a perfectly acceptable choice. They have different tradeoffs (some of which are mentioned in the article but not all), so you may want to consider trade offs, but as a user (e.g. choosing ssh or ssl keys), not a designer, everyone should feel free to choose either from the security perspective. You need to choose the right key size for both, and you need to use the correct vetted tools for both. But there really isn't much of downsides for using either. As a system designer, there are some trade offs, but once again, in almost all practical system designs, both are acceptable security wise.
文章真正论证的是不要自己实现密码学，而非 RSA 本身有问题
这更像是反对“自己造密码”的论据，而不是专门反对 RSA 的论据。
ignoranceprior查看英文原文
This seems to work better as an argument against rolling your own crypto than an argument against RSA in particular.
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选