126
There's a new way to break RSA that's faster than anything we've seen before (arstechnica.com)
submitted 1 month ago by to c/technology@lemmy.world
54 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 1 month ago (9 children)

Fwiw, bitcoin mining amounts to brute forcing SHA256 rather than ECC. Tendency these days for ECC (like in TLS) is to use Curve25519 rather than secp256k1. PQ (post quantum) is an entirely different topic and is in the direction of much more complicated schemes. RSA (or rather, integer factoring) has a long history of falling to better and better attacks, with a (now expired) 512 bit CA certificate recently having been factored on a single workstation. The first fielded deployment was at a nuclear lab and it used 336 bit keys! The big crypto nerds all seem to prefer ECC to RSA now. I tend to defer to them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 1 point 1 month ago (8 children)

    I've moved to ECC because the software packages fight me less in using it (except Microsoft DevOps ssh keys which insist on using RSA - making them the biggest pain in the process lately.)

    RSA is eroding slowly - as all cryptographic algorithms have done historically. The 3072 bit RSA keys I put into practice 10 years ago are still "secure enough" - but I expect after a century they'll look pretty quaint and easily broken as well.

    On the other hand: ECC seems great from all kinds of metrics, easy to implement, small keys, etc. - it just feels like the kind of thing that a clever insight is going to demolish all at once some day, unlike RSA that's sort of gracefully degrading with time.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 3 points 1 month ago (7 children)

    I would say, there are known sub-exponential algorithms for factoring, while nothing better than (exponential) brute force is known for ECC. So, slightly better algorithms that erode RSA further are incremental improvements, while anything sub-exponential at all for ECC would be a breakthrough. Of course as someone once said, predictions are hard to make, especially about the future.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 1 month ago (6 children)

    Just looking at the keys in authorized_keys, that short ECC key feels like any algorithmic breakthrough is going to turn it trivial... RSA already has those easier algorithms, but it also has the brute force bits to make the easier algorithms harder.

    Difficult to see, always moving the future is.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 1 month ago (5 children)

    You could say the same things about AES keys being short.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 1 month ago* (4 children)

    And I do...

    Academically, I trust the more modern algorithms with the shorter keys - not least because all the guidance says to trust them.

    Viscerally, looking at the keys, the short ones just feel more vulnerable.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 1 month ago (3 children)

    Most of us don't have control over the public keys we use. We connect to a web site with a browser, and the server supplies the public key.

    If you want public keys for your own purposes, I guess nothing stops you from generating 4096 bit (or whatever) ECC keys. Of course the arithmetic will be slow.

    If you're really paranoid about potential math advances affecting ECC and/or RSA, then you may be best off avoiding public key schemes altogether. Just use secret keys, and maybe Merkle tree signatures.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 1 month ago (2 children)

    Just use secret keys

    You mean symmetric keys? They're great, but they aren't terribly practical in MANY application scenarios.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 month ago (1 child)

    They can be less convenient, yes, but a situation where you need truly public keys is probably not that secure to begin with. If you're just trying to talk to your friends from your tree house, symmetric encryption is completely practical, including using something like DUKPT for forward secrecy.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •