3 ms·
1024 is for RSA-1024, which is believed to be broken by classical means at this point. Everyone doing anything with RSA is on 4k or larger.
by pclmulqdq 2y ago
1024 is for RSA-1024, which is believed to be broken by classical means at this point. Everyone doing anything with RSA is on 4k or larger.
- Vecr 2y agoThey are? The short term recommendation is 3072, and I still see lots of 2048. Actually, it's mostly 2048.
- deleted 2y ago[deleted]
- wcoenen 2y ago> Everyone doing anything with RSA is on 4k or larger. The Let's Encrypt intermediate certificates R10 and R11 seem to be only 2048 bit.
- pclmulqdq 2y agoA signature (not encryption) with short-term valid life is fine at 2048 still.
- adastra22 2y agoI took this conversation to be about ECC, not RSA.
- notarealllama 2y agoMy completely unfounded tin foil hat at the moment is that ECC was pushed as a standard not because it was faster/ smaller, but the smaller bit size makes it less quantum resistant and is more prone to be broken first (if not already) via quantum supremacy.
- tptacek 2y agoYou're right, that's pretty unfounded.
- marcosdumay 2y agoECC is easier to implement right. Even the older ones that are full of footguns have orders of magnitude less footguns than RSA. So don't fear them due to unfounded theories.
- anonymoushn 2y agoIs there consensus on what signature validation is correct? https://hdevalence.ca/blog/2020-10-04-its-25519am https://hdevalence.ca/blog/2020-10-04-its-25519am
- marcosdumay 2y agoIMO, that article has a clear conclusion that you should aim your software at the libsodium-1.0.16 pattern (no edge cases). The problem it's presenting is more about software on the wild having different behavior... And if "some people connect on the internet and use software that behaves differently from mine" is a showstopper for you, I have some really bad news.
- JanisErdmanis 2y agoAn intersting read. So the general idea as I understand is that one can make signatures that pass or does not pass validation depending on the implementation while all implementations do protect against forgery. In my opinion the correct approach here is the most liberal one for the Q, R points. One checks each point cofactor at parsing 8P=0 and then use unbatched equation for verification. This way implementations can be made group agnostic. Having group agnostic implementations is important as it creates a proper separation of concerns between curve implementations and the code that uses them. For instance if we were to accept strict validation as the ground truth and best practice one would have enormously hard time specifying verifiers for zero knowledge proofs and would also double time and code for the implementers without any effect on soundness.
- pclmulqdq 2y agoDiscrete log doesn't use Shor's algorithm, and appears to need more qubits to break (per key bit).
- tptacek 2y ago2048. There is no plausible conventional attack on 2048; whatever breaks 2048 is probably going to break 4096, as I understand it. https://crypto.stackexchange.com/questions/1978/how-big-an-rsa-key-is-considered-secure-today/1982 https://crypto.stackexchange.com/questions/1978/how-big-an-r...
- FredF--- 2y agoIs it broken? Seems still no one solved RSA-1024 challenge.
- pclmulqdq 2y agoThe state actors aren't going to reveal their capabilities by solving an open challenge.
- rob-olmos 2y agoReminder to anyone if DKIM keys haven't been rotated in a while they might still be 1024. Eg., Google Workspace but new keys are 2048 now.