Tag Info

New answers tagged

2

You never need larger parameters for RSA. In the worst case ElGamal parameters and RSA parameters are equal size. But you can significantly reduce ElGamal parameters depending on the setting you are using for ElGamal. If you are working in $Z_p$ for $p$ beging prime, you work in a field of the same bitlength as required for RSA. But to obtain IND-CPA ...


2

RSA and ElGammal are about equally secure at the same modulus size (assuming, of course, intelligent parameter selection in both cases). For RSA (assuming you use good padding), the best known-attack is to factor the modulus with NFS. For ElGammal (assuming you use a subgroup with a large enough prime factor), the best known-attack is to compute the ...



Top 50 recent answers are included