2048 bits, damn the electrons! [rt at openssl.org: [openssl.org #2354] [PATCH] Increase Default RSA Key Size to 2048-bits]

[Victor Duchovni]

On Thu, Sep 30, 2010 at 01:32:38PM -0400, Thor Lancelot Simon wrote:

> On Thu, Sep 30, 2010 at 05:18:56PM +0100, Samuel Neves wrote:
> > 
> > One solution would be to use 2048-bit 4-prime RSA. It would maintain the
> > security of RSA-2048, enable the reusing of the modular arithmetic units
> > of 1024 bit VLSI chips and keep ECM factoring at bay. The added cost
> > would only be a factor of ~2, instead of ~8.
> 
> This is a neat idea!  But it means changing the TLS standard, yes?

Presumably, this would only speed-up private-key operations. Public-key
operations (which is all one sees on the wire) should be the same whether
there are 2 or 4 unknown factors, one just uses the 2048-bit modulus.

Even the signing CA would not know how many primes were used to construct
the public key, provided software implementations supported 4-prime
private keys, I would naively expect the everyone else to not see any
difference.

Should we be confident that 4-prime RSA is stronger at 2048 bits than
2-prime is at 1024? At the very least, it is not stronger against ECM
(yes ECM is not effective at this factor size) and while GNFS is not
known to benefit from small factors, is this enough evidence that
4-prime 2048-bit keys are effective?

-- 
	Viktor.

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com