4 ms·

Are we post-RSA yet?

• wahern 4y ago
  If and when it happens, ECC will be broken before RSA, as the latter requires roughly an order of magnitude more qubits for the same classical computing complexity. Given how difficult it seems to be to scale quantum computers, there's likely to be a years-long period between ECC being deemed too risky and RSA remaining viable, at least for some tasks. This might (depending on the precise numbers) also be an argument for Curve448 over Curve25519, apropos a recent Golang crypto project rejection of Curve448. Notably, upgrading to a stronger curve is much more difficult from a logistics standpoint because you have to explicitly add code for each curve to various libraries, and then roll them out globally. Generic curve libraries never took hold after side-channel attacks became common. Whereas for RSA larger keys are trivial to support, and generally already supported intrinsically by deployed software. Some RSA libraries currently cap out at 8192, 65536, or some such for pragmatic reasons (e.g. limiting computational complexity attacks or static loop unrolling), but by comparison this is much, much easier to remedy. Of course, larger keys only buy you a little time. But it will be a mad scramble when (and if!) it happens, so that time will be very valuable, and much money will be changing hands.