# Generate an insecure public / private key pair

I am looking for a way to generate an "insecure" public key pair. and by insecure I actually mean a pair that is breakable using brute-force (or other encryption) methods.

As far as I know PGP started with 128bit-keys. and at this point I can only find tools to generate keys using 1024bit or more.

Is there a way to generate a key pair with lets say 56bit (or even less) that will still generate a valid Certificate than can be used in PGP messages?

-
If you mean RSA keys, you can easily factor a 56-bit modulus with trial division. Last I checked, RSA-100 (330 bits) took a night to factor on my computer. But I don't think PGP will accept such short key lengths, everyone will probably reject your certificate. But theoretically, yes, you could. 56 bits may be a bit on the low side, though, since PGP uses padding which mandates a minimum modulus size (140 bits or something). –  Thomas Feb 27 '13 at 1:39
I may correct myself: PGP seems to start with 512bit (even its not recommended and as already mentioned, it may not accept such a certificate at this time) 128bits were used in IDEA algorithm. knowing the minimum key length and after reading through some more examples of the "size" problem - I guess ill just give up the brute-force method at all.. I am sorry for even asking :P instead ill try a dictionary attack on a standard 1024bit key. In case somebody asks: it want to use it for a single email transmission, explained and decrypted within less than 20min. –  Andy P Feb 27 '13 at 8:53
Simply publish your private key, then it is insecure, even with 60000 bits. –  Paŭlo Ebermann Feb 27 '13 at 21:05
you are right. insecure may not be the right therm. I thought "easy to break" would be even more unclear. maybe "weak" fits better. –  Andy P Feb 28 '13 at 9:13
to describe my intention: many symmetric cryptography methods do have their weaknesses - e.g. if you choose a weak key. also I am not sure about their usage in email messages. for asymmetric cryptography it seems, right now, there are only attacks around the method itself (like MitMA, monitor the victim or rubber hose-cryptoanalytics..) because I can not even choose a weak key (by means of bit lenght). so I can only choose a weak passphrase and try to attack from that side. Unless there are better ideas? –  Andy P Feb 28 '13 at 9:13

I am not sure to fully understand your question, but what you can do is the following: take $r=2^{512}$, and compute $p=r+\delta$ and $q=r-\delta^\prime$ such that $p$ and $q$ are prime numbers, and $0\leq \delta, \delta^\prime < 2^{32}$. Then you have an RSA key at you disposal that can be broken by a brute force search on $\delta$, which should take strictly less than $2^{32}$ trials.