4 ms·
It seeds a CSPRNG with 256 bits, then uses the CSPRNG to generate the RSA key. According to most of the estimates listed on http://www.keylength.com/ http://www
by ryan-c 13y ago
It seeds a CSPRNG with 256 bits, then uses the CSPRNG to generate the RSA key. According to most of the estimates listed on http://www.keylength.com/ http://www.keylength.com/ an RSA key needs to be somewhere around 15360 bits to provide a level of security equivalent to a 256 bit symmetric key.
This assumes OpenSSL's CSPRNG is solid, and that /dev/urandom is returning 32 bytes of data that can't be guessed in less than brute force time. I'd be curious to know how big the internal state of that CSPRNG is, actually.
- tptacek 13y agoI'm unclear on the argument that says OpenSSL's CSPRNG is inadequate for the generation of two 7680-bit numbers (there may be one, I just don't know what it is). I don't like the OpenSSL CSPRNG and think OpenSSL would be better if all the random bits just came directly from urandom, but I think OpenSSL's RAND_ functions are up to the task of 15360 bit keys.
- ryan-c 13y agoWhat I'm trying to say is that by the best estimates I am aware of, the point at which it becomes less work to brute force the 256 bit seed than it would take to factor the modulus comes at around 15360 bits.
- tptacek 13y agoOh, I understand what you're saying now. I didn't consider that, because brute-forcing a 256 bit number is totally implausible. :)