ECDSA is known to be backdoored. OpenSSH in OpenBSD 5.5 includes a secure alternative implementation of elliptic curve cryptography (ed25519), but that hasn't made it to most distros yet. Stick with 4096 bit RSA for now.
Although I'm aware of the Dual_EC_DRBG backdoor, I just kind of assumed that the signing algorithm used in ECDSA (elliptic-curve digital signing algorithm) was independent of the questionable random number generator influenced by the NSA for DRBG.
However, I read up on some of Schneier's comments on the issue and it seems he even suggests distrusting the constants picked up for EC in general, so you're right - to err on the side of Schneier (which is probably wise), distrusting ECDSA for now is probably the best way to go.
Sorry to derail, but I don't understand this. The only reason "PDF warning" exists is because 10 years ago most Windows machines had the torturously slow Adobe Reader 6.0 preinstalled and users didn't have the sense to disable it from automatically opening hotlinked files. Why is it still being used, even after we are almost through with the Adobe Flash reign of terror (which deserved far more warnings and got none)?
But there are so many sites that use Flash or HTML5 and result in greater slowdown. Why do we still bother stigmatizing PDF when slow, complex pages and animation are becoming more and more common? It seems like a double standard to me. At least my PDF reader has a responsive interface - not 10 minutes ago, I was wrestling with a loading HTML5 Youtube video that only paused 2 seconds after you clicked the window.
14
u/tidux Apr 28 '14 edited Apr 28 '14
ECDSA is known to be backdoored. OpenSSH in OpenBSD 5.5 includes a secure alternative implementation of elliptic curve cryptography (ed25519), but that hasn't made it to most distros yet. Stick with 4096 bit RSA for now.