There has been a fair amount of discussion about the Bernstein paper which was published last fall. Here are a few articles I founds which give both sides. You can decide for your self. The question is, are you secrets worth someone spending hundreds of millions (or billions) of dollars to crack to key to receive? If not, then there is probably no worry TODAY (but there is always tomorrow).

Articles: http://www.vnunet.com/News/1130451 http://www.rsasecurity.com/rsalabs/technotes/bernstein.html http://www.eweek.com/article2/0,3959,99158,00.asp

For some REALLY lite reading, here is a link to Bernstein's paper: http://cr.yp.to/papers.html#nfscircuit

Enjoy the reading.

Jim

There was a thread on Bugtraq, the initial post of which I cant seem to find, but one had this link to an article:

http://www.eweek.com/article2/0,3959,99158,00.asp

I do recall the estimated cost to implement using off-the-shelf components to be incredibly (phenomenally, astronomically) high, but on a par with the money already invested by certain government's security organizations in satellite surveillance technology. It is, after all, all relative :)

Wish I could find you the original post, but for some reason I only kept the replies..

-----Original Message----- From: arawak [mailto:arawak@blueyonder.co.uk] Sent: Tuesday, July 02, 2002 10:07 AM To: suse-security@suse.com Subject: RE: [suse-security] What's the length of ssh keys?

How much computing power would it take to crack an 1024bit key in a reasonable amount of time?

I thought it would be many years before it could be done, for it to be of any use to anyone?

I have not seen nor heard any info that it has been done as yet...

Dre :o)

Luck is my game ;-) Linux is my aim :)

-----Original Message----- From: Austin Morgan [mailto:admorgan@morgancomputers.net] Sent: 02 July 2002 00:24 To: suse-security@suse.com Subject: Re: [suse-security] What's the length of ssh keys?

While it is true it is possible to break an 1024bit key, it is also difficult. While I am not saying that going to an higher bit key is a bad idea it is also proabably not really necessary. Also ssh is based on ssl so what effects one (as far as keys) effects the other.

Austin Morgan

On Mon, Jul 01, 2002 at 06:23:45PM +0200, Praise wrote:

...

A friend of mine told me that 1024bit keys were broken, and he advised

...

me to use 4096bit keys... I think he is confusing ssl with ssh. Do you have similar information on this?

Praise

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here

-- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com Security-related bug reports go to security@suse.de, not here