Problem - Kevin Tafuro

In the public key world, the future impact of number theory and other interesting
approaches such as quantum computing is a much bigger unknown. Cryptographers
have a much harder time predicting how far out in time a particular key size is going
to be secure. For example, in 1990, Ron Rivest, the “R” in RSA, believed that a 677bit
modulus would provide average security, and 2,017 bits would provide high security,
at least through the year 2020. Ten years later, 512 bits was clearly weak, and
1,024 was the minimum size anyone was recommending (though few people have
recommended anything higher until more recently, when 2,048 bits is looking like
the conservative bet).
Cryptographers try to relate the bit strength of public key primitives to the key
strength of symmetric key cryptosystems. That way, you can figure out what sort of
protection you’d like in a symmetric world and pick public key sizes to match. Usually,
the numbers you will see are guesses, but they should be as educated as possible
if they come from a reputable source. Table 7-1 lists our recommendations. Note
that not everyone agrees what numbers should be in each of these boxes (for example,
the biggest proponents of elliptic curve cryptography will suggest larger numbers
in the nonelliptic curve public key boxes). Nonetheless, these recommendations
shouldn’t get you into trouble, as long as you check current literature in four or five
years to make sure that there haven’t been any drastic changes.
Table 7-1. Recommended key strengths for public key cryptography
Desired security level Symmetric length “Regular” public key lengths Elliptic curve sizes
Acceptable (probably secure 5 80 bits 2048 bits (1024 bits in some cases; 160 bits
years out, perhaps 10)
see below)
Good (may even last forever) 128 bits 2048 bits 224 bits
Paranoid 192 bits 4096 bits 384 bits
Very paranoid 256 bits 8192 bits 512 bits
Remember that “acceptable” is usually good enough; cryptography is
rarely the weakest link in a system!
Until recently, 1,024 bits was the public key size people were recommending. Then,
in 2003, Adi Shamir (the “S” in RSA) and Eran Tromer demonstrated that a $10 million
machine could be used to break RSA keys in under a year. That means 1,024-bit
keys are very much on the liberal end of the spectrum. They certainly do not provide
adequate secrecy if you’re worried about well-funded attackers such as governments.
314 | Chapter 7: Public Key Cryptography
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.