3
$\begingroup$

Daniel Roesler's personal page has a live examples table for WebCrypto support. https://diafygi.github.io/webcrypto-examples/

Without explination he marks several as "Discouraged! Only use for backwards compatibility!". Two of them i am using in my application are RSA-OAEP for encryption, RSASSA-PKCS1-v1_5 for signing. As far as I know they are not broken.

On the other hand ECDSA and HMAC are recommended by him for signing.

Why is no RSA method recommended for encrypting?

So can someone please help me understand the reasoning for marking these methods the way they are?

Is it just that, for example, elliptic curves produce smaller key sizes for the same level of security?

or about potential for missus, or browser implementation?

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ AES-CBC is "discouraged" too in that table... $\endgroup$
    – deviantfan
    Commented Nov 5, 2016 at 11:14

1 Answer 1

Reset to default
4
$\begingroup$

Well, you are as surprised as I believe most of us are...

  • AES-CTR and AES-CBC are "obsolete", whilst AES-CTR is used by AES-GCM. Okay, so maybe he recommends authenticated modes (which don't require making your own authentication). But those aren't obsolete, they are just harder to code properly...
  • DH and all variants of RSA are "obsolete". Only ECDSA and ECDH... There are many asymmetric algorithms that showed up which are meant to replace RSA, but RSA isn't obsolete and will probably remain huge until quantum computers.
  • HKDF-CTR is "obsolete". Should we use PBKDF2 which is designed for passwords and not keys?
  • RSASSA-PKCS1-v1_5 is kind of a problematic choice. Many people still use it, but I believe moving to OAEP and PSS is better in long run. Of course this doesn't mean "obsolete", at most "unrecommended".

All in all, I think "obsolete" isn't correct word. More like: Algorithms that newbies shouldn't use because they aren't obvious what they do. Of course then we should throw in AES-KW and ECDH, because those both are rather not obvious. I think person who created this site wanted to give "best recommendations", but deprecating HKDF-CTR is questionable at least.

TL;DR: This isn't by any means correct, except for SHA-1.

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ I was confused mainly because the recommended list does not include anyway to say encrypt an AES key with another users public key.. something I am currently using RSA-OAEP for. $\endgroup$
    – dave.zap
    Commented Nov 5, 2016 at 13:37
  • 1
    $\begingroup$ @dave.zap And it's ok to be confused, because that table is nonsense $\endgroup$
    – deviantfan
    Commented Nov 5, 2016 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.