5 ms·
Factoring RSA-2048 in 2020 sounds impossible. tptacek said it's extraordinarily unlikely NSA can scalably factor RSA-1024 today [1]. Look at how difficulty in
by wolf550e 12y ago
Factoring RSA-2048 in 2020 sounds impossible.
tptacek said it's extraordinarily unlikely NSA can scalably factor RSA-1024 today [1].
Look at how difficulty increases in the Yafu with GGNFS benchmark on wikipedia [2].
1 - https://news.ycombinator.com/item?id=8844239 https://news.ycombinator.com/item?id=8844239
2 - https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Integer_factorization_and_RSA_problem https://en.wikipedia.org/wiki/RSA_%28cryptosystem%29#Integer...
- raverbashing 12y agoWell, they have very good mathematicians. Also, there's the possibility that even if a product uses a 2048 bit RSA key it might have been weakened. "As of 2010, the largest factored RSA number was 768 bits long" I read this as "today, 1024 bit factorizations are possible"
- tptacek 12y agoBy "scalably factor", I was referring to their ability to take arbitrary 1024 bit public keys as they appeared in random TLS sessions on the Internet and factor them on demand. NSA can virtually certainly target a specific, hardcoded 1024 bit key and break it. In fact, leaving out the cost and difficulty of recruiting the team to actually put the pieces together, the typical California venture capital firm has the resources to build a machine to do that today. Eran Tromer put the cost of such a machine in the single-digit millions, many years ago. Apropos nothing: the gap between a 1024 bit key and a 2048 bit key is enormous. The thing that allows the NSA to meaningfully attack a 2048 bit key is likely to take RSA out altogether (and with it probably multiplicative finite field --- ie, "conventional" --- Diffie Hellman).
- yuhong 12y agoYea, this is one reason why I don't consider 1024-bit end entity certs (as opposed to roots) that much of a threat.
- wolf550e 12y agoWatson Ladd has pointed out that since breaking authentication 10 years after it's been deprecated does not let you retroactively MITM someone but breaking key exchange 10 years after it's been deprecated allows decryption of stored intercepts, KEX should be stronger than certificates. So make sure your TLS server with 1024 bit key uses ECDHE or 2048 bit DHE, not plain RSA KEX.
- yuhong 12y agoYea, it would still be at the customer's own risk.
- psykovsky 12y agoJust because some dude says something in the Internet doesn't make it true. Especially that dude, when he talks about US intelligence agencies.