The first is public key encryption, which lets a user, Alice, publish a public key that allows anyone to send her an encrypted message. RSA is a public-key cryptosystem that has two primary use cases. While it may be theoretically possible to implement RSA correctly, decades of devastating attacks have proven that such a feat may be unachievable in practice. Even worse, padding oracle attacks remain rampant 20 years after they were discovered. Weak parameters can be difficult, if not impossible, to check, and its poor performance compels developers to take risky shortcuts. RSA is an intrinsically fragile cryptosystem containing countless foot-guns which the average software engineer cannot be expected to avoid. Let me save you a bit of time and money and just say outright-if you come to us with a codebase that uses RSA, you will be paying for the hour of time required for us to explain why you should stop using it. But one common denominator in all of these systems is that for some inexplicable reason people still seem to think RSA is a good cryptosystem to use. From major open source projects to exciting new proprietary software, we’ve seen it all. Here at Trail of Bits we review a lot of code.
0 kommentar(er)
