Re: [Cfrg] 1024 bit RSA

My best guess is that some vendor with a major voice in the standard organizations have products that due to a bad design cannot be easily upgraded to a stronger algorithm.

This proves to me that it wrong to leave the IT standardization to vendors.

Erik

-----Oprindelig meddelelse-----
Fra: Cfrg [mailto:cfrg-bounces@irtf.org] På vegne af Hanno Böck
Sendt: 05 November 2016 14:18
Til: cfrg@irtf.org
Emne: Re: [Cfrg] 1024 bit RSA

On Fri, 4 Nov 2016 16:29:54 +0100
"Erik Andersen" <era@x500.eu> wrote:

> I participate in IT smart grid standardization within IEC TC57 WG15. A 
> couple of standards under development still allow 1024 bit RSA keys 
> for so-called backward compatibility. I have so far not been able to 
> change that. My question is now. Is there any information available 
> for how long time or how much effort it takes to break  a 1024 bit RSA 
> key?

Dan Bernstein has made some estimates about the costs of breaking 1024 bit a while ago in a talk:
https://www.youtube.com/watch?v=IuSnY_O8DqQ
He thinks that large botnets may be capable of doing it.

Also to be considered for the attack scenario is that one can break multiple keys at once (batch-nfs by bernstein/lange), which changes the economics of an attack quite a bit:
https://eprint.iacr.org/2014/921

One can probably conclude that attacking 1024 bit rsa is still a very expensive attack. However one should also ask the other question: What is the cost of using a stronger algorithm? I usually tend to have the opinion that we know how to get the basic algorithms right in a way that it's completely infeasible to break them. So let's just use secure algorithms and then use our energy bother about all the other things that can go wrong (next thing up the stack would be "don't use PKCS #1 1.5" and "don't use e=3").

So rather than asking "is rsa 1024 bit secure enough?" I'd ask "is there any significant cost in using rsa 2048?". The performance impact for most applications is almost irrelevant these days.
You cite "backwards compatibility" as a reason, but that's not very specific. Is there a large deployment of devices that only support
1024 bit rsa? If yes then why is that? Are they really old (pre 2003)?
The major warnings against rsa 1024 came in 2003, so if the devices are newer than 2003 and only support rsa 1024 then they have been shipped with substandard crypto (which is quite common, but still bad).
If that's the case then I'd conclude that there is an underlying problem and the call for rsa 1024 is just a symptom of that (and I'd also assume that these devices are probably using other crypto constructions that are scarier than rsa 1024).

--
Hanno Böck
https://hboeck.de/

mail/jabber: hanno@hboeck.de
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

_______________________________________________
Cfrg mailing list
Cfrg@irtf.org
https://www.irtf.org/mailman/listinfo/cfrg