Great news.
I've seen interop issues with people disabling ECDSA for these worries, and I often run into incompatibilities between protocols that only support ed25519, and my hardware tokens/TPMs that only support ECDSA.
I have tried in vain to get projects to allow ECDSA (consistent with prevailing consensus), to address these interop issues.
Hopefully this will persuade jtesta/ssh-audit to not flag ECDSA, also a source of interop issues.
> This contributed to enduring conspiracy theories, which had significant appeal among the non-specialist public (although many have since moved on to other, adjacent, conspiracy theories). All this speculation harmed confidence in robust cryptographic systems and was part of my motivation for the bounty.
>
> This week’s findings completely rule out the technique described by Bernstein and Lange.
This feels a bit harsh? If it was only this week's findings that completely ruled this out, was it so irrational to have been sceptical about ECDSA?
After all, as the author persuasively argues in their post on accelerated PQC timelines:
> If you are thinking “well, this could be bad, or it could be nothing!” I need you to recognize how immediately dispositive that is. The bet is not “are you 100% sure a CRQC will exist in 2030?”, the bet is “are you 100% sure a CRQC will NOT exist in 2030?” [...] Remember that you are betting with your users’ lives.
7 points
Mentions
Great news. I've seen interop issues with people disabling ECDSA for these worries, and I often run into incompatibilities between protocols that only support ed25519, and my hardware tokens/TPMs that only support ECDSA. I have tried in vain to get projects to allow ECDSA (consistent with prevailing consensus), to address these interop issues. Hopefully this will persuade jtesta/ssh-audit to not flag ECDSA, also a source of interop issues. > This contributed to enduring conspiracy theories, which had significant appeal among the non-specialist public (although many have since moved on to other, adjacent, conspiracy theories). All this speculation harmed confidence in robust cryptographic systems and was part of my motivation for the bounty. > > This week’s findings completely rule out the technique described by Bernstein and Lange. This feels a bit harsh? If it was only this week's findings that completely ruled this out, was it so irrational to have been sceptical about ECDSA? After all, as the author persuasively argues in their post on accelerated PQC timelines: > If you are thinking “well, this could be bad, or it could be nothing!” I need you to recognize how immediately dispositive that is. The bet is not “are you 100% sure a CRQC will exist in 2030?”, the bet is “are you 100% sure a CRQC will NOT exist in 2030?” [...] Remember that you are betting with your users’ lives.
Trying to connect to a Dropbear SSH server may give the "** WARNING: connection is not using a post-quantum key exchange algorithm." warning. This might be a false positive, as this Github issue suggests: ssh-audit#375 [1/2]