2
$\begingroup$

So we've been using RSA for a while now. I wonder, is it still secure? I'm wondering whether surveillance agencies can at this point read traffic encrypted with say, TLS_ECDH_RSA_WITH_AES_128_GCM?

Ultimately, what is the best way to implement https? RSA? DSA? ECDSA? ECDH? Is elliptic curve stronger/more secure than RSA? (take quantum computers into account) Does perfect forward secrecy make it impossible to decrypt collected traffic in case the private key get's compromised in the feature? what implementation of https/ssl/tls makes it impossible to bulk collect data and decrypt it afterwards should the key be compromised.

Besides that, what else should be done to ensure data transmitted over https is secure?

Improve this question
$\endgroup$
4
  • $\begingroup$ For TLS you need to use either DHE_* or ECDHE_* for forward secrecy. For RSA and DH use 2048 bit keys. None of RSA, DH or ECC are secure against QCs. $\endgroup$
    – CodesInChaos
    Nov 14, 2015 at 13:13
  • $\begingroup$ @otus definitely too broad. $\endgroup$
    – Alain O'Dea
    Nov 15, 2015 at 21:05
  • $\begingroup$ @otus I didn't know questions have to be qualified/fit certain criteria these days. $\endgroup$
    – Jasper Weiss
    Nov 16, 2015 at 21:23
  • $\begingroup$ @JasperWeiss, yes, there are rules regarding what can and cannot be asked here. However, it seems others think your question is fine, so I'm removing my comment. $\endgroup$
    – otus
    Nov 17, 2015 at 8:33

1 Answer 1

Reset to default
5
$\begingroup$

Assuming you manage to safely generate RSA keys which are sufficiently large, i.e. >= 2048 bits, no TLS configuration flaw on your side, and the lack of security bugs in the TLS library used by your server or the one used by the client user agent, I do not believe TLS_ECDH_RSA_WITH_AES_128_GCM can, at this point, be decrypted by surveillance agencies.

Here's a couple of resources listing best practices for implementing https:

Improve this answer
$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.