Re: [Cfrg] 1024 bit RSA

[Hanno Böck <[e-mail]>]

On Fri, 4 Nov 2016 16:29:54 +0100
"Erik Andersen" <[e-mail]> wrote:

> I participate in IT smart grid standardization within IEC TC57 WG15. A
> couple of standards under development still allow 1024 bit RSA keys
> for so-called backward compatibility. I have so far not been able to
> change that. My question is now. Is there any information available
> for how long time or how much effort it takes to break  a 1024 bit
> RSA key?

Dan Bernstein has made some estimates about the costs of breaking 1024
bit a while ago in a talk:
https://www.youtube.com/watch?v=IuSnY_O8DqQ
He thinks that large botnets may be capable of doing it.

Also to be considered for the attack scenario is that one can break
multiple keys at once (batch-nfs by bernstein/lange), which changes the
economics of an attack quite a bit:
https://eprint.iacr.org/2014/921


One can probably conclude that attacking 1024 bit rsa is still a very
expensive attack. However one should also ask the other question: What
is the cost of using a stronger algorithm? I usually tend to have the
opinion that we know how to get the basic algorithms right in a way
that it's completely infeasible to break them. So let's just use secure
algorithms and then use our energy bother about all the other things
that can go wrong (next thing up the stack would be "don't use PKCS #1
1.5" and "don't use e=3").

So rather than asking "is rsa 1024 bit secure enough?" I'd ask "is
there any significant cost in using rsa 2048?". The performance impact
for most applications is almost irrelevant these days.
You cite "backwards compatibility" as a reason, but that's not very
specific. Is there a large deployment of devices that only support
1024 bit rsa? If yes then why is that? Are they really old (pre 2003)?
The major warnings against rsa 1024 came in 2003, so if the devices
are newer than 2003 and only support rsa 1024 then they have been
shipped with substandard crypto (which is quite common, but still bad).
If that's the case then I'd conclude that there is an underlying problem
and the call for rsa 1024 is just a symptom of that (and I'd also
assume that these devices are probably using other crypto constructions
that are scarier than rsa 1024).

-- 
Hanno Böck
https://hboeck.de/

mail/jabber: [e-mail]
GPG: FE73757FA60E4E21B937579FA5880072BBB51E42