<story><title>RSA is deceptively simple and fun</title><url>https://ntietz.com/blog/rsa-deceptively-simple/</url></story><parent_chain><item><author>glial</author><text>I always hear this caveat, and I&amp;#x27;m sure you&amp;#x27;re right, but I&amp;#x27;m curious about the threat model here. If I roll my own RSA using e.g. GMP[1], what would it take to find vulnerabilities? Is there some automated software that could do it automatically for free&amp;#x2F;cheap, or would it take the resources of a highly specialized org?&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gmplib.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gmplib.org&lt;/a&gt;</text></item><item><author>lisper</author><text>The basics of RSA are deceptively simple and fun but if you actually care about security then there are dozens of details you have to worry about which are deceptively nuanced and complicated.  It&amp;#x27;s fine to play around with toy implementations like this, but you should never ever use such an implementation in an application where security actually matters.  (In fact, if security matters, you probably should not be using RSA at all because there are so many ways to shoot yourself in the foot with it if you are not extremely careful.  ECDH and ECDSA are much better, especially when used with Edwards curves like Curve25519.)</text></item></parent_chain><comment><author>woodruffw</author><text>Generally speaking: if your RSA decryption implementation has &lt;i&gt;any&lt;/i&gt; timing sidechannels, then it is probably vulnerable to some kind of Bleichenbacher variant.&lt;p&gt;As far as I know, GMP doesn&amp;#x27;t many any attempts to be generally resistant to timing channels. This year&amp;#x27;s Bleichenbacher variant[1] specifically calls out GMP&amp;#x27;s modular exponentiation API (which is what you&amp;#x27;d use for RSA) as being susceptible to timing.&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;people.redhat.com&amp;#x2F;~hkario&amp;#x2F;marvin&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;people.redhat.com&amp;#x2F;~hkario&amp;#x2F;marvin&amp;#x2F;&lt;/a&gt;</text></comment>
<story><title>RSA is deceptively simple and fun</title><url>https://ntietz.com/blog/rsa-deceptively-simple/</url></story><parent_chain><item><author>glial</author><text>I always hear this caveat, and I&amp;#x27;m sure you&amp;#x27;re right, but I&amp;#x27;m curious about the threat model here. If I roll my own RSA using e.g. GMP[1], what would it take to find vulnerabilities? Is there some automated software that could do it automatically for free&amp;#x2F;cheap, or would it take the resources of a highly specialized org?&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;gmplib.org&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;gmplib.org&lt;/a&gt;</text></item><item><author>lisper</author><text>The basics of RSA are deceptively simple and fun but if you actually care about security then there are dozens of details you have to worry about which are deceptively nuanced and complicated.  It&amp;#x27;s fine to play around with toy implementations like this, but you should never ever use such an implementation in an application where security actually matters.  (In fact, if security matters, you probably should not be using RSA at all because there are so many ways to shoot yourself in the foot with it if you are not extremely careful.  ECDH and ECDSA are much better, especially when used with Edwards curves like Curve25519.)</text></item></parent_chain><comment><author>pvg</author><text>Random nerds on the internet with little more training than a few of the cryptopals exercises will likely find gaping, game-over vulnerabilities in an RSA implementation you threw together with an arbitrary precision maths library.</text></comment>