0
$\begingroup$

Suppose my very trusting friend has a bitcoin private key with a large balance (let's say $1B USD worth of Bitcoin) and wishes to keep a backup copy with me as a trustee.

He doesn't want to transfer the raw key over an internet connection for obvious reasons, so he asks me to generate an RSA key and send him the public key so he can encrypt his bitcoin private key and then I can decrypt it on my end offline and store my backup of his bitcoin private key.

Is there a realistic risk that someone could brute force the encrypted key that we transferred plaintext over the internet?

| improve this question | |
$\endgroup$
  • 2
    $\begingroup$ Does this answer your question? How much computing resource is required to brute-force RSA? $\endgroup$ – István András Seres Sep 4 at 7:36
  • 2
    $\begingroup$ That question (and accepted answer) are about a very dumb form of brute force. $\endgroup$ – Meir Maor Sep 4 at 8:15
  • 2
    $\begingroup$ What are the risks are you taking into account? Why do you need the RSA? Better use crypto_secretbox_xsalsa20poly1305 $\endgroup$ – kelalaka Sep 4 at 8:50
  • $\begingroup$ @kelalaka I genuinely thought that was a made up protocol name until I googled it $\endgroup$ – Albert Renshaw Sep 4 at 21:52
  • 1
    $\begingroup$ You don't just need RSA (or any other asymmetric algorithm), you need a protocol to encrypt your "bitcoin private key" and a way to share & verify the public key associated to it. Keeping the key secure after you'd received it would be as important. However, this Q/A site is about questions about cryptography, not so much system security. Remember: cryptography is not the answer (by itself). For that amount of cash I'd go for RSA 8192 or something similarly ridiculous, just to be sure. $\endgroup$ – Maarten Bodewes♦ Sep 7 at 8:47
4
$\begingroup$

2048 bit RSA is currently and for the foreseeable future secure.

512 bit is currently not considered useful.

1024 bit RSA though not currently known to be cracked doesn't have enough security margins for comfort. Definitely not for securing $1B USD. Several years ago the cost of a machine which could break 1024 bit RSA in a year was a few million. Cost presumably went down. And it is likely certain 3 letter organizations have such machines.

The best way to attack RSA is by factorizing the composite $n$ using Number Field Sieve. and though $1B is a lot of money I don't believe there is a known design which will break 2048 bit RSA for that budget.

However, there are other attacks to think of. Starting with how you share your public key. How does your friend know your public key is indeed yours. Then there are various side channel attacks on RSA, if the attacker has timing or power or noise measurements of you computing stuff with the private key that can help.

Then of course to protect a $1B secret there better be plenty of physical security around your key.

Should large quantum computers become available RSA may be broken also for significant key sizes. Personally I don't expect this any time soon but plenty of smart people disagree.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thanks, this answers my question sufficiently! $\endgroup$ – Albert Renshaw Sep 4 at 21:41
2
$\begingroup$

Brute-forcing an RSA key is basically impossible (AES uses a 128, 192 or 256-bit key, while RSA uses 2048, 3074, or 4096). That said, brute-force wouldn't be the attack of choice for RSA since the difficulty of breaking RSA is based on the difficulty of factoring a large semi-prime. Since most numbers aren't prime you have significantly less work to do... I won't get into the details of prime factorization but common wisdom is a 2048-bit key is approximately 128 bits of security against modern factorization methods, and generally considered to be usable until 2040. 4096-bit keys are considered usable after 2040, but with quantum computing on the rise that's soon to change.

But in short, yes, RSA will be just fine; unless your threat model includes an attacker with multiple hundreds of millions of dollars to blow on a computer that doesn't exist yet you'll be fine.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Could you provide a reference for " 2048-bit key is approximately 128 bits of security against modern factorization methods, and generally considered to be usable until 2040"? That's considered rather high amount of security for a 2048 bit key. $\endgroup$ – Maarten Bodewes♦ Sep 7 at 8:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.