6
$\begingroup$

I need asymmetric pub/private keypair encryption in JavaScript. Web browsers support RSA-OAEP, which works exactly as I need. But there is a table which lists supported algorithms for web crypto at https://diafygi.github.io/webcrypto-examples/ ... and RSA-OAEP is marked using red color (Discouraged, only use for backwards compatibility).

Is there any problem with RSA-OAEP? Should it be replaced by different algos? Or do you think that the person who wrote the table was wrong by marking RSA-OAEP red? Thank you

$\endgroup$
  • $\begingroup$ On github the question was asked about sources - and notice the distinct lack of an answer. The table probably shows only a personal preference - but that's also just speculation. $\endgroup$ – tylo Sep 19 '17 at 15:34
9
$\begingroup$

RSA in general is often considered to be "discouraged" for new projects. For quite some years, the rallying cry has been "switch to elliptic curves", but nowadays there are calls for going straight for so-called "post-quantum" schemes.

RSA benefits from having survived a lot of public scrutiny (arguably, integer factorization is a problem that has been under studied for three millenia at least), and while there has been substantial progress in cryptanalysis, 2048-bit RSA key are likely to remain secure for a long time. There are also good and bad ways to use RSA for asymmetric encryption, but RSA-OAEP is about as good as you can get with RSA, so that's fine.

Elliptic curves offer better performance (on the decryption side) and are more fashionable. What this means is that before being actually broken, RSA may become disused, meaning that you will get interoperability issues, and implementations will be poorly maintained at some point. In my view, none of this is critical.

Quantum computers eat RSA keys for breakfast; however, they also munge through elliptic curves at lunch time, so that's not a good argument for switching to curves. It's a fortunate thing that quantum computers don't really exist yet (and whether they will exist at some point is an open question). "Post-quantum" schemes are algorithms that appear to resist quantum computers (specifically, these are algorithms for which no efficient quantum-solving attack is known – which does not mean that such attacks don't exist!). There is no real post-quantum drop-in replacement for classic algorithms yet (there are good candidates, but a lot of standardization and implementation deployment is still needed).

$\endgroup$
5
$\begingroup$

You'll have to ask the author of that site why they made that assessment.

Although there's no technical reason to prefer RSA-OAEP over the much simpler (to implement and to study) RSA-KEM, RSA-OAEP is more widely standardized and deployed, as RSAES-OAEP in PKCS#1 v2.

There are other RSA-based public-key encryption schemes out there, but since that site doesn't list any of them, my only guess is that the author of that site prefers ECDH-based public-key key encapsulation methods over all RSA-based public-key encryption schemes.

But largely, WebCrypto was based on parroting standards full of acronym soup for backwards compatibility with archaic pantheons of cryptographic doohickeys, rather than carefully analyzing crypto engineering needs of novel applications like NaCl. So who can say what rhyme or reason goes into the product of that process?

This table itself doesn't help by confounding many unrelated operations and security properties into a single table, as if there were any reason to put RSASSA-PSS and RSAES-OAEP and AES-CMAC and AES-CTR side by side in a single table as if they were comparable types of objects—magic crypto black boxes with a different subset of buttons you can push to summon the crypto fairies.

$\endgroup$
  • $\begingroup$ I believe the author made an strongly opinion-based decision to deprecate RSA-OAEP in this case. $\endgroup$ – DannyNiu Sep 19 '17 at 1:31
  • $\begingroup$ @DannyNiu: Can you be more specific? Do you mean the author of the table unilaterally decided on the basis of their technical opinion that RSA-OAEP ought to be deprecated, no matter what current practice or standard status is? Or do you mean the WebCrypto editors made the decision that RSA-OAEP should be formally deprecated in the standard, for which one could dig up a citation? $\endgroup$ – Squeamish Ossifrage Sep 19 '17 at 1:47
  • $\begingroup$ I mean the former, that they unilaterally decided on the basis of their own technical opinion. $\endgroup$ – DannyNiu Sep 19 '17 at 1:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.