Re: [DNSOP] More keys in the DNSKEY RRset at ., and draft-ietf-dnsop-respsize-nn

[Paul Hoffman <[e-mail]>]

On Jan 14, 2014, at 3:04 PM, George Michaelson <[e-mail]> wrote:

> If multiple independent entities sign, can't they elect to use shorter algorithms?
> 
> I know 'short can be spoofed' is out there, but since there are now n * <512> instead of 1 * 2048 is it not theoretically possible that at a cost of more complexity, it can be demonstrated that as long as 1) the sigs are all current 2) all the sig agree then the risk of n 512-bit signings is not necessarily worse than one 2048 or 4096 bit signing, for the specific need we have: proof of correctness. (n is unstated. 512 is a nonce. I have no idea what the sweet spot of keysize and number of keys would be.)
> 
> therefore, if this is true, trading complexity for keysize might not increase the initial bootstrap zone transfer size that much.
> 
> I am not a cryptographer and do not play one on TV

I am not a cryptographer but I *do* play one on television, and that proposal is terrible. Breaking asymmetric keys gets logarithmically harder as the key size goes up; that's why no one has publicly broken a 1024-bit RSA key, even though they have had much, much more time (and now-faster CPUs) than the earlier breaks.

It would orders of magnitude easier to break 4 512-bit keys than one 2048-bit key. The work would also parallelize better so that you need smaller systems to do the work.

--Paul Hoffman