4 ms·

> don't use weak moduli. By this do you mean don't use 1024 bit keys? Would using 2048 bit (or larger) mean that the NSA wouldn't be able to buy a computer th

by olympus 11y ago

> don't use weak moduli. By this do you mean don't use 1024 bit keys? Would using 2048 bit (or larger) mean that the NSA wouldn't be able to buy a computer that could do the computation within a year? Why don't we all use 2048 bit keys then? Is the communication and processing overhead so high that we'd rather be vulnerable? Edit to add: I'm not an expert, but I'm competent enough to force a certain level of crypto on my computer and to know not to trust the communication when a website forces a fallback to a lower level. But sometimes I wish there was a level of explanation (of why we want to do certain things) that was above what you would give to "Joe off the street" and below the explanation that you would give to a graduate student in cryptography.

tptacek 11y ago
NSA almost definitely can't buy a computer that can break 2048 bit conventional multiplicative group discrete logs, and if by same insane space-alien-technology chance they can, the implication is that conventional multiplicative group discrete logs are probably entirely unsuitable for secure cryptography: no amount of jazz-hands with parameters will save you. Reminder: 2048 bit discrete logs aren't just twice as hard as 1024 bit discrete logs! Yes: 2048 bit RSA and DH are significantly slower than 1024 bit, and that's a big part of why they're still in use.
snuxoll 11y ago
> By this do you mean don't use 1024 bit keys? Would using 2048 bit (or larger) mean that the NSA wouldn't be able to buy a computer that could do the computation within a year? Keep in mind, going from 1024 to 2048 bit DH parameters doesn't double the search space, it raises it from 2^1024 to 2^2048. At some point the search space gets so large that you'd need more energy than required to boil all of Earth's oceans to find the key, which makes such a brute-force attack implausible.
- cinquemb 11y ago
  I haven't had much crypto-in-practice background (outside of thought experiments), but I have some math background so I'm quite curious. Shouldn't people also be worried about non brute force attacks based on finding mathematical solutions? I mean, "The Uneasy Relationship Between Mathematics and Cryptography"[0]? [0] http://www.ams.org/notices/200708/tx070800972p.pdf http://www.ams.org/notices/200708/tx070800972p.pdf
  - tptacek 11y ago
    The attacks we're talking about are non-brute-force mathematical attacks (specifically, in this case, the index calculus). A pure brute-force attack on a 2^1024 search space would be comically implausible.
- netheril96 11y ago
  Actually that is wrong. The search space of 1024 bit Diffie Hellman is about 2^80, of 3248 bit about 2^128. I failed to find a number for 2048 bit DHE.

by olympus 11y ago

tptacek 11y ago

NSA almost definitely can't buy a computer that can break 2048 bit conventional multiplicative group discrete logs, and if by same insane space-alien-technology chance they can, the implication is that conventional multiplicative group discrete logs are probably entirely unsuitable for secure cryptography: no amount of jazz-hands with parameters will save you. Reminder: 2048 bit discrete logs aren't just twice as hard as 1024 bit discrete logs! Yes: 2048 bit RSA and DH are significantly slower than 1024 bit, and that's a big part of why they're still in use.

snuxoll 11y ago

> By this do you mean don't use 1024 bit keys? Would using 2048 bit (or larger) mean that the NSA wouldn't be able to buy a computer that could do the computation within a year? Keep in mind, going from 1024 to 2048 bit DH parameters doesn't double the search space, it raises it from 2^1024 to 2^2048. At some point the search space gets so large that you'd need more energy than required to boil all of Earth's oceans to find the key, which makes such a brute-force attack implausible.

cinquemb 11y ago
I haven't had much crypto-in-practice background (outside of thought experiments), but I have some math background so I'm quite curious. Shouldn't people also be worried about non brute force attacks based on finding mathematical solutions? I mean, "The Uneasy Relationship Between Mathematics and Cryptography"[0]? [0] http://www.ams.org/notices/200708/tx070800972p.pdf http://www.ams.org/notices/200708/tx070800972p.pdf
- tptacek 11y ago
  The attacks we're talking about are non-brute-force mathematical attacks (specifically, in this case, the index calculus). A pure brute-force attack on a 2^1024 search space would be comically implausible.
netheril96 11y ago
Actually that is wrong. The search space of 1024 bit Diffie Hellman is about 2^80, of 3248 bit about 2^128. I failed to find a number for 2048 bit DHE.