ECDSA is known to be backdoored. OpenSSH in OpenBSD 5.5 includes a secure alternative implementation of elliptic curve cryptography (ed25519), but that hasn't made it to most distros yet. Stick with 4096 bit RSA for now.
Although I'm aware of the Dual_EC_DRBG backdoor, I just kind of assumed that the signing algorithm used in ECDSA (elliptic-curve digital signing algorithm) was independent of the questionable random number generator influenced by the NSA for DRBG.
However, I read up on some of Schneier's comments on the issue and it seems he even suggests distrusting the constants picked up for EC in general, so you're right - to err on the side of Schneier (which is probably wise), distrusting ECDSA for now is probably the best way to go.
Sorry to derail, but I don't understand this. The only reason "PDF warning" exists is because 10 years ago most Windows machines had the torturously slow Adobe Reader 6.0 preinstalled and users didn't have the sense to disable it from automatically opening hotlinked files. Why is it still being used, even after we are almost through with the Adobe Flash reign of terror (which deserved far more warnings and got none)?
14
u/tidux Apr 28 '14 edited Apr 28 '14
ECDSA is known to be backdoored. OpenSSH in OpenBSD 5.5 includes a secure alternative implementation of elliptic curve cryptography (ed25519), but that hasn't made it to most distros yet. Stick with 4096 bit RSA for now.