-
Notifications
You must be signed in to change notification settings - Fork 160
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Updated TLS Cipher Suites, ECC Curves and a new TopSecurity item
Added Untrusted Font Blocking Mitigation to the Top Security category Configured TLS category by removing the insecure CBC TLS Cipher Suites, Please view GitHub Readme TLS section for more info. Configured TLS ECC Curves to utilize more secure curves.
- Loading branch information
Showing
2 changed files
with
16 additions
and
13 deletions.
There are no files selected for viewing
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Related: #42
5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
according to https://safecurves.cr.yp.to/, curve25519 is (more) safe than NIST curves, so IMHO curve25519 should have higher priority.
5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I set
nistP521first because it's available in FIPS mode and also has a bigger bit length compared tocurve25519https://learn.microsoft.com/en-us/windows/win32/secauthn/tls-elliptic-curves-in-windows-10-1607-and-later
https://www.rfc-editor.org/rfc/rfc9142.html
5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@rafalfitt Sorry I couldn't find where in the page you linked to it says
curve25519is safer thannistP521, could you show me a screenshot? thank you5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
https://cr.yp.to/talks/2013.05.31/slides-dan+tanja-20130531-4x3.pdf
nistP521 is not included in:
https://wicg.github.io/webcrypto-secure-curves/
https://www.rfc-editor.org/rfc/rfc7748.txt (Recommended Curves: Curve25519, Curve448)
5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
"If you're looking for a 128-bit security level, then anything in the TLS 1.3 list should be sufficient except ffdhe2048. If you're looking for a 192-bit security level, then you'll need ffdhe8192, x448, secp384r1, or secp521r1. Note that in some implementations, while secp256r1, x25519, and x448 are constant time, secp384r1 and secp521r1 are not, so you should make sure that your implementation only configures elliptic curves that are implemented in a constant-time manner. This is the main reason I prefer the non-NIST curves: because they're easier to implement in a constant-time way and as a result almost always are."
https://crypto.stackexchange.com/questions/87648/which-diffie-hellman-groups-does-tls-1-3-support-and-should-we-use-tls-1-3-as-a
5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
"Ed25519 is a safe default choice for most applications where a digital signature is appropriate, for many reasons"
"NIST P-521 (ECDSA, secp521r1)
Biggest curve is best curve! — the clueless"
https://soatok.blog/2022/05/19/guidance-for-choosing-an-elliptic-curve-signature-algorithm-in-2022/
5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks, it was a very interesting read 🙂
Based on that article,
NIST P-521is the most secure one, and it's FIPS approved. They claim it's overkill but it's the best we've got for Harvest Now, Decrypt Later scenarios.Plus, prioritizing it at the top doesn't mean it will be 100% guaranteed to be used. It's just prioritizing it, so if the server/client/software supports it then it will use it, if not then they will use
curve25519and if that is not supported thenNistP384and finallyNistP256.I really don't see any problem with the current configuration, the most secure one is prioritized but it obviously comes with performance penalties, but that's what this repository is aiming for, highest possible security, and as mentioned earlier, there is Quantum computers problem, rouge countries harvesting bulk data now and decrypting them later when they have access to Quantum computation.
Despite
NIST P-521being prioritized, in Wireshark i often see other curves being used.None of the websites you linked to state that
NIST P-521is less secure thancurve25519, they either fail to even talk about it or only talk aboutcurve25519. but never said that Nist one is less secure, on the contrary, they say it's more secure but refer to it as overkill.NistP521 uses 521 bit key size and offers 256 bit security level. Curve25519 uses 256 bit key size and offers 128 bit security level.
5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
just asking: have you seen https://cr.yp.to/talks/2013.05.31/slides-dan+tanja-20130531-4x3.pdf ?
5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, I read that too, written by the same person who released
curve25519and includes some delusional comments about how Nist curves include NSA backdoors, seen a bunch of those comments made in forums. EVEN if that's true, NSA isn't the organization we need to worry about. Only people who need to worry about those things are adversaries such as Russia, China, North Korea, Iran and such countries.5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am worried about the last slide: NIST curves are missing some several important (not sure - I am a newbie) features.
5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I am a newbie too in cryptography and verifying their deeper details, I think we should open a new question in https://crypto.stackexchange.com/ and ask which one is more secure, regardless of being developed by NSA and ignoring the performance penalties.
need opinion of people that are not biased against NIST, I say opinion because if we wanted to verify their answers we'd need to have deeper knowledge of cryptography and mathematical calculations related to them.
5b5be1fThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
fair enough ;-)