Hacker News Reader

Comment by LeoPanthera | Hacker News Reader

Can someone explain to me why RSA 2048 is "recommended to change"? It's still the default for gpg keys and as far as I know is widely thought to be secure for at least few hundred years!

View on HN

It could have to do with the NSA's August 2015 plan for transitioning to quantum-resistant algorithms. In their new Commercial National Security Algorithm (CNSA) Suite, they advise a minimum 3072-bit RSA modulus:

https://www.iad.gov/iad/programs/iad-initiatives/cnsa-suite....

(Doh... I don't know why I'm getting an invalid certificate authority error when trying to access that site, but Qualys SSL Labs confirms it's a real error. Yikes.)

I did not read it due to the certificate problem. Could someone post an abstract here?

Here's a copy of their CNSA FAQ:

https://cryptome.org/2016/01/CNSA-Suite-and-Quantum-Computin...

Also: with quantum computing still in its infancy, how do we actually know which types of keys would be adequate?

Koblitz and Menezes explore various theories about the NSA's new policy in their paper, A Riddle Wrapped In An Enigma:

https://eprint.iacr.org/2015/1018.pdf

For anyone reading the thread, this is an absolute must-read paper if you're at all interested in the near-future of production cryptosystems in high-risk settings.

Not a direct answer to your question, but http://pqcrypto.org has a lot of great information on post-quantum crypto.

The certificate is issued by the DOD's internal CA. Not sure why they're using one for a public facing site though.

They're DOD so why not. There's a lot of them that do. What confused me was that browsers in US didnt trust DOD PKI... probably quite reliable... while they have plenty of shady, less-secure CA's on their list.

Without commenting at all on the practicalities of attacking it, it's reasonable to expect a higher level out of security from GPG than a standard TLS connection.

Your web server needs to key and manage many connections/sec, and any delays feed back into my web developers further arguing against the use of TLS. You can generally expect no one will be trying to break your current TLS sessions ten years from now. If that doesn't apply to your situation, you probably have bigger problems, such as the broken CA model.

Both of these scenarios may be different with GPG.

2048 bit is fine.

It's probably not secure for a hundred years because of quantum computers. But none of the currently supported algs in openssh protects against quantum computers, therefore there's nothing you can do against it right now.

No, not even close to a few hundred years. No more than ~20 years at this point. https://www.keylength.com/en/4/

Read: you are safe using 2048 now.

The arguments for using a longer modulus all reduce down to "you'll have to eventually, why not now?" rather than any new threat against 2048-bit modulus keys.

Reply on news.ycombinator.com