Re: [Cfrg] 1024 bit RSA

[Peter Gutmann <[e-mail]>]

Ilari Liusvaara <[e-mail]> writes:

>In summary, I would guess that factoring RSA 1024 keys would be within reach
>of groups who could do ASIC design and then ordering custom chips off fabs.
>Of course, that's still many millions, so one would need the financial case
>of spending that much money (it is going to be millions of dollars at the
>very least).

And that's the key point, would anyone bother?  There's always the
hypothetical government-level attacker with magical access to infinite
resources lurking in the shadows, but as Snowden has shown, they don't need to
spend that much to get in, or build crypto-breakers to do it.  If I was an NSA
program manager and someone came to me and said "we need $100M to build an
ASIC-based RSA cracker, which we should have tested, debugged, and operational
in two years", I'd reply "here's a full *one hundredth* of that amount, you've
got a week to get in by backdooring or subverting or bribing or whatever"
(with an optional side-order of "yer lazy bastard" in an Ernest Borgnine
accent).

Even if there was absolutely no other way in, I can't see how you could
justify building something like that unless you were using it to attack
something of extraordinarily high value like the single RSA-1024 key that the
Kremlin uses to communicate with all its local offices.  DH group 2 (group 1
in SSH terminology), sure (although an RSA-breaker can't do anything with
those anyway), but some random RSA key somewhere?

Peter.