1
$\begingroup$

Two cryptographic schemes—RSA accumulators, and RSA-based Verifiable Delay Functions (VDFs) such as this one—require an RSA modulus to operate. These RSA constructions are secure if the trapdoor, namely the factorisation of the RSA modulus, is secret. In the context of a blockchain we do not want to trust anyone with the trapdoor.

The RSA public key of a dead (or presumed dead) cryptographer could be acceptable as a "trustless" RSA modulus. (Or at least, one of several moduli for an accumulator or a VDF built from multiple parallel sub-accumulators or sub-VDFs.) The idea is that the trapdoor, stored in the cryptographer's brain, disappears upon death. I tried to find an RSA key (e.g. from a PGP key) for Aaron Swartz and Satoshi Nakamoto, without success.

Are there famous dead cryptographers that have an RSA public key attached to their name?

$\endgroup$
  • 1
    $\begingroup$ Why a cryptographer? $\endgroup$ – fkraiem Sep 1 '18 at 11:39
  • $\begingroup$ Right, doesn't have to be. Cryptographers may have better cyber hygiene than most. $\endgroup$ – Randomblue Sep 1 '18 at 11:48
3
$\begingroup$

What you're looking for is hard-to-factor numbers where no one knows the factorization.

One approach to do this is to use the larger numbers in the RSA Factoring Challenge. These are composite numbers selected by RSA Laboratories, in an attempt to encourage research on factorization methods. As such, they went to great lengths to make sure that no one knew the factorization (including destroying the PC that generated the factors afterwards).

While the smaller numbers on the list have been factored, the larger ones (including RSA2048) have not.

I believe that this would address the problem you are attempting to solve.

$\endgroup$
  • $\begingroup$ Right, RSA-2048 is a great candidate. I wondered if there are others out there. (As I mentioned, you can combine moduli from various sources to reduce trust.) $\endgroup$ – Randomblue Sep 1 '18 at 20:50
2
$\begingroup$

I don't see why a dead cryptographer makes the modulus more trustworthy.

Your argument is based on the assumption that a good cryptographer can keep his private key in his brain, thus when he/she passed away, the private key will go with him and become a secret no one knows.

However, I doubt a human can really memorise a private RSA key, which a long random string, and without having any forms of backup of the key. Most likely, the key is resting somewhere in a digital or other form of storage system. So it may not go away with its owner.

Secondly, if there were such a trusted modulus used in practice, then it would attract a lot of cracking efforts. The likelihood that the factors being found would be much higher. And the worst thing is that you cannot easily replace it because you would have to find another dead cryptographer. You will sure run out of keys after some time because there aren't that many choices.

$\endgroup$
  • 1
    $\begingroup$ "I doubt a human can really memorise a private RSA key" => Usually they memorise a password to unlock an encrypted version of the RSA key. $\endgroup$ – Randomblue Sep 1 '18 at 13:30
  • $\begingroup$ "The likelihood that the factors being found would be much higher." => The same argument holds for Certificate Authorities, etc. The probability of factoring a 2048-bit key should be close to zero for the next few years. $\endgroup$ – Randomblue Sep 1 '18 at 16:13
  • $\begingroup$ "Usually they memorise a password to unlock an encrypted version of the RSA key" => This again is your assumption. The problem is that "a dead cryptographer" does not imply "the private key is lost", and the latter is what you want I guess. $\endgroup$ – Changyu Dong Sep 1 '18 at 20:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.