Re: [Cfrg] 1024 bit RSA

[Peter Gutmann <[e-mail]>]

Hanno Böck <[e-mail]> writes:

>One can probably conclude that attacking 1024 bit rsa is still a very
>expensive attack. However one should also ask the other question: What is the
>cost of using a stronger algorithm?

Yup, and in combination with that, what's being protected/what's your threat
model?  The example I've used on a number of occasions is a 512-bit key being
used with a system that turns a ventilator on and off (details fudged slightly
to make the actual item non-recognisable to the company running it :-).  The
system is old (meaning it's a current product but the hardware was designed
in... not sure, late 90s I think, or maybe earlier), it can't handle keys
larger than 512-bit (heck, it struggles with 512-bit keys), and even using a
512-bit key is complete overkill, AFAICT the motivation for it is some sort of
checklist-compliance for the auditors, "yes we use crypto", rather than a need
to protect it from anything (the crypto was a later addition, some time
post-2000).

It's easy enough for people operating in splendid isolation from real life to
say "we should all be using [insert chosen numerology here]-sized keys for
everything all the time", but in practice it depends on a whole pile of
factors, of which "what theoretical strength in bits do we need" is several
steps down the list behind "how much will it cost", "what can the hardware
cope with", "what are we protecting", "what's the risk", and several others.

Peter.