0
$\begingroup$

I decided to use TweetNaCl in my project and did some tests. For some reason, its Ed25519 signing mechanism gives me very short public and private keys, as opposed to RSA, though RSA, as I it explained to me, is not secure.

enter image description here

So can I trust this implementation, experts, please?

Improve this question
$\endgroup$
5
  • $\begingroup$ Duplicate of security.stackexchange.com/questions/101044/… $\endgroup$ – bkjvbx Dec 31 '17 at 10:20
  • $\begingroup$ bkjvbx, it's not exactly duplicate, because I didn't have any doubt about Ed25519 per se, I only wanted to know if this particular "TweetNaCl" (which looks suspiciously small) is a good implementation of Ed25519 (I didn't know that short keys offer the same security, because I never saw it in action). As Frank Denis stated, I cant trust it. Thank you! $\endgroup$ – shal Dec 31 '17 at 11:57
  • $\begingroup$ RSA is not secure? That's new to me. The only thing when RSA is not secure is when a too small key size is used or if mistakes are made during protocol definition or implementation. But the RSA problem certainly is considered secure at the moment. It only really has to fear Quantum Computing right now, and QC would definitely break ECC even faster. RSA is not efficient though; certainly not during key pair generation - as you already noticed. $\endgroup$ – Maarten Bodewes♦ Jan 2 '18 at 16:23
  • $\begingroup$ Funny enough, this question would be on topic if you would constrain it to the question about the (encoded) key size. That other Q/A is on a different site, and those should not be considered for dupes (a bit of a grey area, the other question should really be migrated here by now). However, asking if an entire implementation is secure or not is too broad and/or opinionated - in my opinion anyway. $\endgroup$ – Maarten Bodewes♦ Jan 2 '18 at 16:26
  • $\begingroup$ @shal I personally know (and trust) the implementors of Tweetnacl. I don't know about Ed25519 but I pretty much formally verified the curve25519 implementation and I can guarantee that there are no bug in it. $\endgroup$ – Biv Jan 4 '18 at 0:18
4
$\begingroup$

As explained in the link posted by bkjvbx, the short keys and signatures offer the same security level as ~3000-bit RSA.

Regarding the implementation, TweetNaCL's code has been written by experts, has been carefully reviewed and is something you can trust. The only catch is that it is very slow.

Improve this answer
$\endgroup$
1
  • $\begingroup$ The speed doesn't bother me. Besides, I've noticed that it generates key pair way much faster than RSA does. Thank you very much! $\endgroup$ – shal Dec 31 '17 at 11:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.