44
Those appear to be based on the complexity of the General Number Field Sieve, one of the fastest (if not the fastest) classical factoring algorithms. I confirmed this in Mathematica.
Here is the complexity for the GNFS (source):
$$\exp\left( \left(\sqrt[3]{\frac{64}{9}} + o(1)\right)(\ln n)^{\frac{1}{3}}(\ln \ln n)^{\frac{2}{3}}\right)$$
where $n$ is a ...
42
TL;DR: no longer unconditionally.
As of 16 Feb 2021, the Bitcoin miners hashed at an aggregate rate of $\approx154 \cdot10^{18}H/s$ according to this source, where one hash is two nested SHA-256; that is $\approx2^{93.0}$ SHA-256 per year.
Here is this data redrawn in SHA-256 per year with a $\log_2$ vertical scale, to facilitate comparison with key size in ...
36
wondering what the largest integer is which they were able to factor with a small quantum computer
Stunts
Before the present answer, the largest claim for quantum-related factoring seems to have been 4088459=2017×2027, by Avinash Dash, Deepankar Sarmah, Bikash K. Behera, and Prasanta K. Panigrahi, in [DSBP2018] Exact search algorithm to factorize large ...
28
The input length of OAEP is directly specified in the standard:
M message to be encrypted, an octet string of length mLen,
where mLen <= k - 2hLen - 2
or simply mLen = k - 2 * hLen - 2 if we want to calculate the maximum message size.
Where:
k - length in octets of the RSA modulus n
hLen - output length in octets of hash function Hash
...
23
You need to consider the weakest link property: a security system is never stronger than its weakest link. Since Argon2 is a password-based function, the weak link here is going to be the strength of your users' passwords. Choosing a longer output length doesn't help if the passwords' entropy is lower than that.
Think of it this way: if the hash function ...
22
Examining his claims about "Thundercloud":
You can use it with "any existing software, operating system, or device" (a massive amount of effort---by whom?)
Has its "own cryptographic language that is completely independent of any existing security technology" (this is a negative thing: abandoning the entire knowledge base of cryptography is incredibly ...
21
A key size of 80 bits is the historical limit of infeasibility; that's what was used in the 1990s as a rule of thumb. That's the reason why Skipjack used an 80-bit key, and SHA-1 offers a 160-bit output. Various people have also estimated that a 1024-bit RSA, DH or DSA key offers an "80-bit equivalent" protection (see this site).
One of the most optimistic ...
21
The only rule for the key is that it should at least contain 256 bits of randomness. If the key is smaller you may not get the full security of HMAC-SHA-256. The full security of HMAC is basically identical to the output size. Unless you are trying to protect yourself against quantum computers you should be able to get away with a key that contains 128 bits ...
21
In summary:
Modern practice is to fix a small public exponent $e$ such as $e=2^{(2^4)}+1=65537$, then choose a public modulus $N$ of $\text{nlen}$ bits (the key size) with large random prime factors compatible with $e$, then compute the RSA private exponent $d$ from that. With near certainty, that $d$ will be at least $\text{nlen}/2$-bit. That can be used ...
19
That's not the same kind of key.
Symmetric keys are a bunch of bits, such that any sequence of bits of the right size is a possible key. Such keys are subject to brute force attacks, with a cost of $2^n$ for an $n$-bit key. 128 bits are way beyond that which is brute-forceable today (and tomorrow as well). If a block cipher is "perfect," then ...
19
512 bits (rounded down from the 664 bits or 200 digits in the patent) was recommended from its conception in 1974 and throughout the 1980s. Indeed, 463 bits was considered sufficient in the mid-1990s for the RSA-140 challenge. Whether key strengths as low as 100 digits (330 bits) were ever used in the early 1980s embedded systems is unclear; but probable ...
17
Despite similarities, it is really important to understand that passwords and cryptographic keys should not be carelessly conflated. Some important contrasts:
Passwords are normally selected by human beings according to their whims. Cryptographic keys are meant to be randomly generated by an algorithm.
Passwords are usually intended to be memorized by ...
16
Actually, the problem is that the above quote uses the term "discrete log" in a way that's different from what you're thinking of.
When someone uses the term "discrete log", they can mean two things:
A discrete log in the group $Z^*_p$; that is, given $p$, $g$ and $g^x \bmod p$, recover $x$
A discrete log in some other group; that is, given a group $G$, a ...
14
SHA-512 has both a larger internal state and a higher number of rounds than SHA-256 - which means that it provides a higher bit strength. Somewhat surprisingly it may also outperform SHA-256, as it uses 64 bit word size, which works best on 64 bit processors. You can see a good comparison table on Wikipedia
If less bits are required from SHA-512 then they ...
14
No, it doesn't help. It doesn't hurt either; as long as you don't repeat keys, the probability of success is always the same. That is, if there are $2^n$ possible keys, and you test $\lambda$ of them, the probability you hit the right one is always $\lambda / 2^{n}$.
A key generated by a high quality random number generator (or a good key derivation ...
13
The security level of an elliptic curve group is approximately $\log_2{0.886\sqrt{2^n}}$. You can use this to approximate the security level of a $n$-bit key, eg:
$\log_2{0.886\sqrt{2^{571}}} = 285.32537860389294$
The real computation (at least for curves over a finite field defined by a prime $p$) is $ \log_2{\sqrt{\pi/4}\sqrt{ℓ}} $, where $ℓ$ is the ...
13
I know that humans would find it impossible to maintain a 128 bit password -- however, I wonder if there is some technical reason why a 52 bit password would not be as weak as a 52-bit encryption key for that matter.
First, I would argue that 128 bits is not impossible to remember. My current password manager master password is almost 100 bits (6 words from ...
13
There isn't just one, because there are many different scenarios where you'd use such a function, where the attacker has lesser or greater powers, or variably stringent success goals—different attack models. For example:
Does the attacker know any plaintext/ciphertext pairs encrypted with the same key? (Known plaintext attack)
Is the attacker able to ...
12
I saw many people complainig about AES , twofish and serpent that these ciphers all could be crackable in the near future and even today with big datacenters .
This is a good example of why we should always ask for citations and explanations, rather then just accepting what people say at face value with no scrutiny. These claims are about as far from ...
11
It depends on how long you want to keep your data safe for. Do you
want the secret safe for 1 week, the rest of your life or forever? Will you get in trouble, put in prison or be killed if that secret is revealed to the wrong person?
It also depends on who you want to keep the data safe from. Do you want your data protected from nation state-level ...
11
No, the RSA key size is not the size of the private key exponent. It is customarily the number of bits in the public modulus (which is known as $N$). In other words, the key size is the integer $k$ such that $2^{k-1}\le N<2^k$.
In most implementations (and all implementations conforming to PKCS#1), a private exponent $d$ has size in bits at most the key ...
11
The triple DES (3DES) block cipher works by essentially running the block through DES three times. Triple DES is also known as "DES EDE" (encrypt-decrypt-encrypt) and under the name given by the standard document: "TDEA". The TDEA algorithm is described in FIPS NIST Special Publication 800-67
Revision 1 where paragraph 3.2 describes the TDEA Keying Options.
...
11
Coprocessors are designed for improved performance in a certain case, and in the case of fixed-width mathematics, I do not believe you would see a performance increase.
I am quite sure that 80-bits is simply because it is 10, 8-bit words, and not that it is targeting the 80-bit registers in a FPU. Primarily, it would be inconvenient to use an FPU for this ...
10
I saw many people complainig about AES , twofish and serpent that these ciphers all could be crackable in the near future and even today with big datacenters
Let me go through some of the lesser known details about the NSA's capabilities, and how fast they are able to break AES-256:
Their annual budget has been drastically underreported; it is actually $...
9
Presumably, it's because they rounded it down to a nice round number of bits. Nobody's going to use an 86.76611925028119 bit key in practice, but an 80-bit key is plausible.
Besides, the 86.whatever bit symmetric key length is only approximate, anyway: even using the GNFS, implementation details could easily swing it several bits either way, and of course, ...
9
A 4000-bit RSA key is reasonable (more precisely, that would be the bit size of the public modulus; and 4096-bit would be more common). But it is not reasonable to memorize it (or, more precisely, that the owner try to memorize the corresponding private key); and that's practically never done.
One does not ask normal users to memorize or remember a key, or ...
9
AES-128 requires keys 128 bits in length, period.
As Thomas points out in his comment, the size of characters is encoding-dependent, so there is no well-defined "number of characters" in an AES key. AES cares about bits for its input, not characters.
Low-entropy passwords should be converted into key material with a password-stretching KDF with appropriate ...
9
GPG's AES-256 symmetric encryption is believed to be as secure as it is difficult to
guess the passphrase
or compromise the machine used to perform encryption and decryption.
Guessing the passphrase should be harder if one uses
gpg --s2k-mode 3 --s2k-count 65011712 --s2k-digest-algo SHA512 --s2k-cipher-algo AES256
or equivalently puts in the gpg.conf ...
9
The original SHA-1 and Skipjack specifications did not provide a justification for using a 80-bit key size, so we can only speculate about the reasons. However, it is important to understand that from a historical basis, an 80-bit key was considered adequate (barely) to be secure against exhaustive search for a few decades. It was clear that a 64-bit key ...
8
I'll expand on the comment I left on my answer.
The purpose of Part 2 of NIST SP 800-57 is to "[provide] guidance on policy and security planning requirements for U.S. government agencies". Keeping that in mind, the table on page 64, i.e. the table from whence the numbers in that question came, includes more than just RSA key sizes. Namely, it includes some ...
Only top voted, non community-wiki answers of a minimum length are eligible
