Re: [Cfrg] 1024 bit RSA

All the comments have been quite useful. Let me express my concern.

There is a cyber war out there and it is been use politically.

When it comes to smart grid, it will be very depending on a complex IT
infrastructure (primarily using SCADA protocols). Our electricity networks
are very critical infrastructures. The Ukraine black-out is a warning about
what we might expect. My country (Denmark) and our allies are not always
acting as other great powers may want. The threat to bring down a critical
infrastructure could affect the policy making. We should not leave too many
soft spots in our defence wall. My question was actually. Is a 1024 RSA key
such a soft spot? From what I hear, the answer might be yes.

Erik

-----Oprindelig meddelelse-----
Fra: Cfrg [mailto:cfrg-bounces@irtf.org] På vegne af Peter Gutmann
Sendt: 05 November 2016 04:51
Til: Ilari Liusvaara <ilariliusvaara@welho.com>; Hal Murray
<hmurray@megapathdsl.net>
Cc: Cfrg <cfrg@irtf.org>
Emne: Re: [Cfrg] 1024 bit RSA

Ilari Liusvaara <ilariliusvaara@welho.com> writes:

>In summary, I would guess that factoring RSA 1024 keys would be within 
>reach of groups who could do ASIC design and then ordering custom chips off
fabs.
>Of course, that's still many millions, so one would need the financial 
>case of spending that much money (it is going to be millions of dollars 
>at the very least).

And that's the key point, would anyone bother?  There's always the
hypothetical government-level attacker with magical access to infinite
resources lurking in the shadows, but as Snowden has shown, they don't need
to spend that much to get in, or build crypto-breakers to do it.  If I was
an NSA program manager and someone came to me and said "we need $100M to
build an ASIC-based RSA cracker, which we should have tested, debugged, and
operational in two years", I'd reply "here's a full *one hundredth* of that
amount, you've got a week to get in by backdooring or subverting or bribing
or whatever"
(with an optional side-order of "yer lazy bastard" in an Ernest Borgnine
accent).

Even if there was absolutely no other way in, I can't see how you could
justify building something like that unless you were using it to attack
something of extraordinarily high value like the single RSA-1024 key that
the Kremlin uses to communicate with all its local offices.  DH group 2
(group 1 in SSH terminology), sure (although an RSA-breaker can't do
anything with those anyway), but some random RSA key somewhere?

Peter.
_______________________________________________
Cfrg mailing list
Cfrg@irtf.org
https://www.irtf.org/mailman/listinfo/cfrg