Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

No; ECC is better. But as an implementor, if you're hoping to DIY, you're even worse off with ECC than with RSA; there are more parameters and validations steps you can get wrong with ECC that will result in a flawed implementation.

The security of these hardware devices is not tied to the RSA algorithm per se. The devices might not be more resilient against these attacks simply by using ECC instead of RSA.

Either way: don't implement RSA or ECC yourself. Use something like PGP/GPG.



(warning: noob alert) just out of curiosity, is there an open source implementation of a securid-like server/client.

I'm not even sure what the encryption technology is called, but it would be very cool to play with.


OATH is the competing open standard to SecurID, as far as I know, and there's plenty of code that supports it. It's also what the Gmail 2FA and Google Authenticator are based on (so you can use any OATH client to authenticate to Gmail).


(FYI, The OpenPGP specification got ECC support a couple of weeks ago http://tools.ietf.org/html/rfc6637)




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: