From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: =?iso-8859-1?Q?Hanno_B=F6ck?= <hanno@hboeck.de>, "cfrg@irtf.org"
 <cfrg@irtf.org>
Thread-Topic: [Cfrg] 1024 bit RSA
Thread-Index: AdI2ru4LNTqSoFCyQtexI2PQtTMFhAASx9AAAB4vto8=
Date: Sat, 5 Nov 2016 14:43:15 +0000
Message-ID: <1478356984469.74085@cs.auckland.ac.nz>
References: <005a01d236b0$4b247470$e16d5d50$@x500.eu>,
 <20161105141754.3d34c2ac@pc1>
In-Reply-To: <20161105141754.3d34c2ac@pc1>
Accept-Language: en-NZ, en-GB, en-US
Content-Language: en-NZ
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/cfrg/uW3LwfdPykbqrbAaP4B3tzdoMXY>
Subject: Re: [Cfrg] 1024 bit RSA
Precedence: list

Hanno B=F6ck <hanno@hboeck.de> writes:=0A=
=0A=
>One can probably conclude that attacking 1024 bit rsa is still a very=0A=
>expensive attack. However one should also ask the other question: What is =
the=0A=
>cost of using a stronger algorithm?=0A=
=0A=
Yup, and in combination with that, what's being protected/what's your threa=
t=0A=
model?  The example I've used on a number of occasions is a 512-bit key bei=
ng=0A=
used with a system that turns a ventilator on and off (details fudged sligh=
tly=0A=
to make the actual item non-recognisable to the company running it :-).  Th=
e=0A=
system is old (meaning it's a current product but the hardware was designed=
=0A=
in... not sure, late 90s I think, or maybe earlier), it can't handle keys=
=0A=
larger than 512-bit (heck, it struggles with 512-bit keys), and even using =
a=0A=
512-bit key is complete overkill, AFAICT the motivation for it is some sort=
 of=0A=
checklist-compliance for the auditors, "yes we use crypto", rather than a n=
eed=0A=
to protect it from anything (the crypto was a later addition, some time=0A=
post-2000).=0A=
=0A=
It's easy enough for people operating in splendid isolation from real life =
to=0A=
say "we should all be using [insert chosen numerology here]-sized keys for=
=0A=
everything all the time", but in practice it depends on a whole pile of=0A=
factors, of which "what theoretical strength in bits do we need" is several=
=0A=
steps down the list behind "how much will it cost", "what can the hardware=
=0A=
cope with", "what are we protecting", "what's the risk", and several others=
.=0A=
=0A=
Peter.=