computation,
that takes (relatively) negligible storage and communication, the number
field sieve requires massive amounts of data, and the linear algebra
step could become (even more of) a problem.
Best regards,
Samuel Neves
[1] http://eprint.iacr.org/2010/006
[2] http://eprint.iacr.org/2009/389
the schemes by Goh et al. [2] that are
reducible to the CDH and DDH problems in generic abelian groups (like
EC.) Would patents also apply to one of these schemes over an elliptic
curve?
Best regards,
Samuel Neves
[1] http://www.cacr.math.uwaterloo.ca/techreports/2000/corr2000-54.ps
[2] http
box over a few days/weeks).
Best regards,
Samuel Neves
-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com
If an attacker creating a special-purpose machine to break your keys is
a realistic scenario, why are you even considering keys of that size?
Best regards,
Samuel Neves
On 15-08-2010 04:25, John Gilmore wrote:
... 2048-bit keys performing
at 1/9th of 1024
improvement on
the speed of ECDLP breaking (I'll make no bets on AES, though).
Best regards,
Samuel Neves
-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com
Forwarded at Andrew's request.
Original Message
Subject: Re: 2048-bit RSA keys
Date: Tue, 17 Aug 2010 19:11:55 -0500 (CDT)
From: Andrew Odlyzko odly...@umn.edu
To: Samuel Neves sne...@dei.uc.pt
CC: cryptography@metzdowd.com
It is not unreasonable
by NFS costs around 2^80 operations.
Thus, I believe that 4-prime RSA-2048 is slightly easier than 2-prime
RSA-2048, but still significantly harder than RSA-1024.
Best regards,
Samuel Neves
-
The Cryptography Mailing List
Unsubscribe
