<story><title>ProtonMail now offers elliptic curve cryptography</title><url>https://protonmail.com/blog/elliptic-curve-cryptography/</url></story><parent_chain><item><author>KirinDave</author><text>This announcement is an example of why I am not using ProtonMail anymore. There are a lot of things they do that sound very good on marketing materials, but upon examination are security theater.&lt;p&gt;For example, they claim, &amp;quot;We have chosen a particular elliptic curve system known as X25519, which is fast, secure, and particularly resistant to timing attacks. It’s simple to implement&amp;quot;.&lt;p&gt;However, previously they&amp;#x27;ve said that they use Indutny&amp;#x27;s library [0]. This library is somewhat infamous because its leadership deciding to discard any pretense of defending against timing attacks on the grounds that would make the library &amp;quot;too slow.&amp;quot; [1]&lt;p&gt;There are other options. They could have used something with good timing attack resistance from WebCrypto. Those options exist. Folks with more skill than I have recommended P-256 as an option.&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;protonmail.com&amp;#x2F;blog&amp;#x2F;openpgpjs-3-release&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;protonmail.com&amp;#x2F;blog&amp;#x2F;openpgpjs-3-release&amp;#x2F;&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;indutny&amp;#x2F;elliptic&amp;#x2F;issues&amp;#x2F;128#issuecomment-302593662&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;indutny&amp;#x2F;elliptic&amp;#x2F;issues&amp;#x2F;128#issuecomment-...&lt;/a&gt;</text></item></parent_chain><comment><author>bartbutler</author><text>We are aware of the the issues brought up in [0] and [1]. As suggested in [2], we are already considering to switch to an implementation in WebAssembly to mitigate the possibility of timing attacks on the web platform.&lt;p&gt;In our mobile and desktop apps, where timing attack resistance is easier to achieve, the X25519 implementation is already constant-time.&lt;p&gt;Once they are generated, keys are controlled by our users and not easily updated, so we wanted to make our choice of default curve as future-proof as we could while balancing speed and interoperability.&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;indutny&amp;#x2F;elliptic&amp;#x2F;issues&amp;#x2F;128&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;indutny&amp;#x2F;elliptic&amp;#x2F;issues&amp;#x2F;128&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;bugs.debian.org&amp;#x2F;cgi-bin&amp;#x2F;bugreport.cgi?bug=861639#10&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bugs.debian.org&amp;#x2F;cgi-bin&amp;#x2F;bugreport.cgi?bug=861639#10&lt;/a&gt;&lt;p&gt;[2]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;openpgpjs&amp;#x2F;openpgpjs&amp;#x2F;issues&amp;#x2F;720&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;openpgpjs&amp;#x2F;openpgpjs&amp;#x2F;issues&amp;#x2F;720&lt;/a&gt;</text></comment>
<story><title>ProtonMail now offers elliptic curve cryptography</title><url>https://protonmail.com/blog/elliptic-curve-cryptography/</url></story><parent_chain><item><author>KirinDave</author><text>This announcement is an example of why I am not using ProtonMail anymore. There are a lot of things they do that sound very good on marketing materials, but upon examination are security theater.&lt;p&gt;For example, they claim, &amp;quot;We have chosen a particular elliptic curve system known as X25519, which is fast, secure, and particularly resistant to timing attacks. It’s simple to implement&amp;quot;.&lt;p&gt;However, previously they&amp;#x27;ve said that they use Indutny&amp;#x27;s library [0]. This library is somewhat infamous because its leadership deciding to discard any pretense of defending against timing attacks on the grounds that would make the library &amp;quot;too slow.&amp;quot; [1]&lt;p&gt;There are other options. They could have used something with good timing attack resistance from WebCrypto. Those options exist. Folks with more skill than I have recommended P-256 as an option.&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;protonmail.com&amp;#x2F;blog&amp;#x2F;openpgpjs-3-release&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;protonmail.com&amp;#x2F;blog&amp;#x2F;openpgpjs-3-release&amp;#x2F;&lt;/a&gt;&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;indutny&amp;#x2F;elliptic&amp;#x2F;issues&amp;#x2F;128#issuecomment-302593662&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;indutny&amp;#x2F;elliptic&amp;#x2F;issues&amp;#x2F;128#issuecomment-...&lt;/a&gt;</text></item></parent_chain><comment><author>bogomipz</author><text>&amp;gt;&amp;quot;There are a lot of things they do that sound very good on marketing materials, but upon examination are security theater.&amp;quot;&lt;p&gt;Indeed like still pushing the trope that since their datacenters are located in Switzerland they are able to provide more privacy protections. This is even mentioned on their homepage, and of course this hasn&amp;#x27;t been true in a few years now.[1]&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.bbc.com&amp;#x2F;news&amp;#x2F;world-europe-37465853&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.bbc.com&amp;#x2F;news&amp;#x2F;world-europe-37465853&lt;/a&gt;</text></comment>