▲ 126 ▼ There's a new way to break RSA that's faster than anything we've seen before (arstechnica.com) submitted 1 month ago by return2ozma@lemmy.world to c/technology@lemmy.world 54 comments fedilink hide all child comments
[–] solrize@lemmy.ml 1 point 1 month ago (5 children) You could say the same things about AES keys being short. permalink fedilink source parent hideshow 5 child comments replies: [–] MangoCats@feddit.it 1 point 1 month ago* (4 children) And I do... Academically, I trust the more modern algorithms with the shorter keys - not least because all the guidance says to trust them. Viscerally, looking at the keys, the short ones just feel more vulnerable. permalink fedilink source parent hideshow 4 child comments replies: [–] solrize@lemmy.ml 1 point 1 month ago (3 children) Most of us don't have control over the public keys we use. We connect to a web site with a browser, and the server supplies the public key. If you want public keys for your own purposes, I guess nothing stops you from generating 4096 bit (or whatever) ECC keys. Of course the arithmetic will be slow. If you're really paranoid about potential math advances affecting ECC and/or RSA, then you may be best off avoiding public key schemes altogether. Just use secret keys, and maybe Merkle tree signatures. permalink fedilink source parent hideshow 3 child comments replies: [–] MangoCats@feddit.it 1 point 1 month ago (2 children) Just use secret keys You mean symmetric keys? They're great, but they aren't terribly practical in MANY application scenarios. permalink fedilink source parent hideshow 2 child comments replies: [–] solrize@lemmy.ml 1 point 1 month ago (1 child) They can be less convenient, yes, but a situation where you need truly public keys is probably not that secure to begin with. If you're just trying to talk to your friends from your tree house, symmetric encryption is completely practical, including using something like DUKPT for forward secrecy. permalink fedilink source parent hideshow 1 child comment replies: [–] MangoCats@feddit.it 1 point 1 month ago a situation where you need truly public keys is probably not that secure to begin with. A banking website? permalink fedilink source parent
[–] MangoCats@feddit.it 1 point 1 month ago* (4 children) And I do... Academically, I trust the more modern algorithms with the shorter keys - not least because all the guidance says to trust them. Viscerally, looking at the keys, the short ones just feel more vulnerable. permalink fedilink source parent hideshow 4 child comments replies: [–] solrize@lemmy.ml 1 point 1 month ago (3 children) Most of us don't have control over the public keys we use. We connect to a web site with a browser, and the server supplies the public key. If you want public keys for your own purposes, I guess nothing stops you from generating 4096 bit (or whatever) ECC keys. Of course the arithmetic will be slow. If you're really paranoid about potential math advances affecting ECC and/or RSA, then you may be best off avoiding public key schemes altogether. Just use secret keys, and maybe Merkle tree signatures. permalink fedilink source parent hideshow 3 child comments replies: [–] MangoCats@feddit.it 1 point 1 month ago (2 children) Just use secret keys You mean symmetric keys? They're great, but they aren't terribly practical in MANY application scenarios. permalink fedilink source parent hideshow 2 child comments replies: [–] solrize@lemmy.ml 1 point 1 month ago (1 child) They can be less convenient, yes, but a situation where you need truly public keys is probably not that secure to begin with. If you're just trying to talk to your friends from your tree house, symmetric encryption is completely practical, including using something like DUKPT for forward secrecy. permalink fedilink source parent hideshow 1 child comment replies: [–] MangoCats@feddit.it 1 point 1 month ago a situation where you need truly public keys is probably not that secure to begin with. A banking website? permalink fedilink source parent
[–] solrize@lemmy.ml 1 point 1 month ago (3 children) Most of us don't have control over the public keys we use. We connect to a web site with a browser, and the server supplies the public key. If you want public keys for your own purposes, I guess nothing stops you from generating 4096 bit (or whatever) ECC keys. Of course the arithmetic will be slow. If you're really paranoid about potential math advances affecting ECC and/or RSA, then you may be best off avoiding public key schemes altogether. Just use secret keys, and maybe Merkle tree signatures. permalink fedilink source parent hideshow 3 child comments replies: [–] MangoCats@feddit.it 1 point 1 month ago (2 children) Just use secret keys You mean symmetric keys? They're great, but they aren't terribly practical in MANY application scenarios. permalink fedilink source parent hideshow 2 child comments replies: [–] solrize@lemmy.ml 1 point 1 month ago (1 child) They can be less convenient, yes, but a situation where you need truly public keys is probably not that secure to begin with. If you're just trying to talk to your friends from your tree house, symmetric encryption is completely practical, including using something like DUKPT for forward secrecy. permalink fedilink source parent hideshow 1 child comment replies: [–] MangoCats@feddit.it 1 point 1 month ago a situation where you need truly public keys is probably not that secure to begin with. A banking website? permalink fedilink source parent
[–] MangoCats@feddit.it 1 point 1 month ago (2 children) Just use secret keys You mean symmetric keys? They're great, but they aren't terribly practical in MANY application scenarios. permalink fedilink source parent hideshow 2 child comments replies: [–] solrize@lemmy.ml 1 point 1 month ago (1 child) They can be less convenient, yes, but a situation where you need truly public keys is probably not that secure to begin with. If you're just trying to talk to your friends from your tree house, symmetric encryption is completely practical, including using something like DUKPT for forward secrecy. permalink fedilink source parent hideshow 1 child comment replies: [–] MangoCats@feddit.it 1 point 1 month ago a situation where you need truly public keys is probably not that secure to begin with. A banking website? permalink fedilink source parent
[–] solrize@lemmy.ml 1 point 1 month ago (1 child) They can be less convenient, yes, but a situation where you need truly public keys is probably not that secure to begin with. If you're just trying to talk to your friends from your tree house, symmetric encryption is completely practical, including using something like DUKPT for forward secrecy. permalink fedilink source parent hideshow 1 child comment replies: [–] MangoCats@feddit.it 1 point 1 month ago a situation where you need truly public keys is probably not that secure to begin with. A banking website? permalink fedilink source parent
[–] MangoCats@feddit.it 1 point 1 month ago a situation where you need truly public keys is probably not that secure to begin with. A banking website? permalink fedilink source parent