alt Hacker News> Your 1024 bit key is only "fine" because you are a small fry, not because cryptographers think it cannot be attacked.
This is falling for an xkcd 538 fallacy, btw. Nation states obviously have vast higher capability to subvert individual data than brute forcing its crypto. I stand by what I said: 1024-bit RSA keys are "fine" and will remain so. RSA-309 will not fall within our lifetime.
> it's very much possible that factoring is much easier than expected
And this is sort of toothless? I mean, that's true for ECC too. It's true for all cryptography. It's true for all software. For all engineering. For all math. We'll never know what we don't know. New discoveries tomorrow may upend everything any given property ("safety" is just one) we think our existing machines hold.
But they probably won't. And the moments where that happens are extremely rare. And to be blunt RSA already got hit with that particular lightning bolt.
Replies
any cryptography can break at any time. Sometimes "sudden" breaks happen. You can't defend against these, so there (perversely) isn't that much of a point worrying about them, besides using schemes many people have thought about for a while.
Another way cryptography breaks is via iterative improvements. For example, in the last few months there are two big cryptanalytic stories
1. The novel scheme (though not standardized) HAWK had its security reduced by ~1/2 by AI. It is no longer compelling in any way. This was in a sense "predictable" though. There was a series of papers showing that HAWK-like schemes were vulnerable to an attack of this type. Then, AI was able to bridge the gap and apply these attacks directly to HAWK.
2. The ISO-standardized scheme McCliece (from ~45 years ago) has had some alarming security reductions, and may be effectively broken (it's still a little early to tell, many cryptanalytic papers require heuristics that must be justified, etc). Again, this was in a sense "predictable". Starting ~3 years ago it was discovered that McCliece had some yet-unexploited structure, and since then there have been more and more papers exploiting this further, until recently more dramatic attacks have occurred.
In both cases, there is a clear "story" you can (post-hoc) tell about the attacks. You can't always predict precisely where the attacks will end up (for the McCliece attack, it appears more effective than I would have predicted at least). But you can often tell when things are gradually weakening, before a full collapse.
RSA has a cousin (binary characteristic finite field DH) that had this gradual weakening into total collapse happen in the 2010s. It is possible this cousin was a problem child, and GNFS will remain the best attack against RSA until quantum computers fully break it. I can't predict the future. But I can say that ECC has had no such problematic cousins.
This is to say that we are blessed that we have extremely strong cryptography available. Why you would choose to use the weakest defensible option is beyond me, and not something anyone serious about security would ever recommend doing. There is no upside, and only downsides.
There's also the question of why anyone would bother. You can factor RSA-1024 today in about a year with a national-lab-level supercomputer. Which 1k-bit RSA key would you shut down a national lab for a year for to factor? Heck, which key would you shut it down for a week for to factor? There's no single key out there of any interest when you can just spear-phish your intended target, or get RCE on their unpatched router, or get the cleaners to plug in a USB key and let it do its thing while they're vaccuuming, or whatever.
That's a weirdly confident prediction. Why do you think 309 isn't going to fall in our lifetimes?
"SHA2 will never be broken in our lifetimes" is something I've heard JP Aumasson say many times, but that's based on the fact that there's no line of sight anywhere to techniques that could break it. But you can't say that about 1024 bit RSA.