1024-bit RSA keys In Danger Of Compromise?

antiher0 writes "According to an email from Lucky Green that came across bugtraq yesterday, 1024-bit encryption should no longer be considered pristine. Bernstein released a proposal that outlines the creation of a machine capable of breaking 1024-bit crypto on the order of minutes or even seconds for the measly cost of ~$1B USD. For a more thorough discussion, check out the original email." Update: 03/26 03:16 GMT by T : And don't forget to revisit Bruce Schneier's analysis of Bernstein's claims, which cast doubt on the practicality of breaking such large keys anytime soon.

Comments

Break my crypto for $1B?

[brer_rabbit]

Don't waste your money. I'll sell my company's secrets for a fraction of that.

Arbitrary costing = $1B

[Nathdot]

I can picture the scenario now:

<TELEPHONE CORRESPONDANCE>
SHADY GOVERNMENT OPERATIVE: So how much will this 1024 decryption system cost?
PIMPLY TEEN HACKER: $1B US dollars to be deposited into my secure off-shore bank account and safe passage to the Maldives.
SHADY GOVERNMENT OPERATIVE: Excellent. The money is being transferred as we speak. Begin work.
</TELEPHONE CORRESPONDANCE>

<PIMPLY TEEN HACKER INTERNAL MONOLOGUE>
Sweet! I've just charged the US government 1 billion dollars for a beowulf cluster of dreamcasts running home-brew linux.
</PIMPLY TEEN HACKER INTERNAL MONOLOGUE>

<SHADY GOVERNMENT OPERATIVE INTERNAL MONOLOGUE>
Sweet! We will retrieve the 1 billion dollars once we crack the secure off-shore bank account's 1024 bit encryption system
</SHADY GOVERNMENT OPERATIVE INTERNAL MONOLOGUE>

:)

Re:Clearing up the deceptive intro

[Tom7]

...show that factoring 1024-bit length primes is doable for 1 billion dollars or so.

Oops, Mr. Smarty Pants! I can factor 1024-bit primes for $0!

Haha fools!!!

[NoMoreNicksLeft]

This is why I use 1025 bits. Suckers.

Re:Would obscurity be a solution?

[Shiny Metal S.]

As for layering in general. Well it works for the most part (e.g 3DES) although there are caveats (2DES would not be safe).

That's correct. Once I wanted to make ROT13 stronger, so I decided to encrypt the message twice, but I discovered that 2ROT13 was actually less safe than ROT13. I finally used 3ROT13 and even 5ROT13 for the most sensitive data, however I'm not sure how much more secure is 5ROT13 than 3ROT13, but what the hell, the overhead is not very high.