4 ms·

I think the point is as computers get faster there is less trade off in having longer bit lengths, rather than focusing on the potential to crack sad keys. Tha

• nailer 3y ago
  They cover that in the article: > Quantum computing of the sort intended to break RSA involves a breakthrough in both computing and algorithms. Normally some sort of new computing technology is invented and then algorithms are designed to enable that technology to do something useful. The quantum computing threat to RSA is different. We now have the algorithm (Shor's) but the computer to run it on only exists in our imagination. > If someone were to invent such a computer then RSA 2048 would be immediately and trivially breakable. RSA 3072 would also be trivially breakable. The same applies to RSA 4096 and 8192.
  • roomey 3y ago
    They can't know that however, they may say it but they can't know it. Hence why not choose key lengths by looking at encoding and decoding resource usage instead of crackability. By costs nothing I mean as CPUs get faster there is less performance impact on lenghtening keys
    • nailer 3y ago
      They already are, hence everyone moving to ED25519 (which uses less CPU for the equivalent key strength) instead of RSA.
• hujun 3y ago
  `That is, if it costs very little to have larger keys, why not have larger keys?` it is often very expensive/difficult to change length of a RSA key is part of existing platform/infrastructure, like key in TPM/HSM/CA infrastructure, regardless how fast computer CPU is
  • zokier 3y ago
    But RSA has been long time going out, and short-keyed RSA doubly so. I would estimate that since maybe 2015ish deploying stuff that is coupled to 2048bit RSA would have been mistake. That gives generous 15ish year transition period. Anyone who cares even the slightest should succeed transition in that sort of timeframe.
    • tptacek 3y ago
      Why would deploying 2048 bit RSA be a mistake? If you believe 2048 is threatened in a meaningful time frame, when 1024 hasn't even been broken (thus sort of implying that the collapse of 2048 will occur in a much shorter time frame than the one separating 512 and 1024), is there any realistic RSA key size that should make you comfortable?
      • adgjlsfhk1 3y ago
        3 reasons 1. it's reasonable to assume the NSA is a decade ahead and has more computers than academia. 2. you want your secrets to last a decade (or longer) 3. the total amount of data you're encrypting per client is only 256 bits anyway (the size of a symmetric key) so the absolute performance impact is relatively minimal
• bawolff 3y ago
  > even if quantum computing key factorisation works, key lengths will still have an impact on the difficulty of factorisation, and it may make a difference in terms of practicality. I mean, the whole thing with quantum computer factoring is it scales well. Getting to 2048 rsa seems really really difficult. But if we ever get there, getting to 4096 is probably just a tiny extra step.
  • alphager 3y ago
    The current state of quantum computing suggests that there is an exponential effort to increase the available qbits. Going from RSA 2048 to RSA 4096 would not just double the effort required on the quantum side.
    • upofadown 3y ago
      Wouldn't that effectively prevent a threat to 2048 bit RSA in the first place?
      • ihattendorf 3y ago
        Almost like there's no free lunch. I don't see quantum computing ever really taking off without a fundamental breakthrough in our understanding of physics. Would love to be proven wrong though if my understanding is incorrect and there's actually a feasible path towards quantum computing at scale.
        • bawolff 3y ago
          I dont think there is any fundamental physics reasons preventing quantum computers. My understanding is it is an engineering problem. A hard one no doubt, but not a fundamental physics one. Anyways, my point was that getting a quantum computer at a decent scale is really difficult. If we manage to overcome that burden somehow, the difference between 2048 bit rsa abd 4096 bit is peanuts.
  • roomey 3y ago
    Well, we can't know. Maybe it would be trivial, maybe it could keep your data safe for 5ore years. Maybe it could double the cost to crack. No one can know at the moment, hence the trade off, if it costs very little to do a longer key, why not do a longer key?