4 ms·
RSA1024 isn't as much of a problem for DNSSEC, though it is being increased. The validity period and the amount of data being encrypted restricts the attacker t
by TrueDuality 10y ago
RSA1024 isn't as much of a problem for DNSSEC, though it is being increased. The validity period and the amount of data being encrypted restricts the attacker to a much larger degree. That being said, I don't think RSA is the correct choice anymore for speed, security, or size of DNS responses.
You can find more information here: https://www.cloudflare.com/dns/dnssec/ecdsa-and-dnssec/ https://www.cloudflare.com/dns/dnssec/ecdsa-and-dnssec/
- byuu 10y agoI was definitely thinking, "why not use Curve25519 for a 256-bit key if fitting the response into one packet is so important?" It seems there's some worry about quantum computers being able to break ECC with less qubits than RSA on account of there being less actual bits. But to me, it seems like if quantum computers come about that start breaking things, RSA is going to need to be replaced as well. So now's probably not the time to be too paranoid about something we don't yet know will ever even happen. At least, not until we have something we know will be resilient to the new quantum attacks.