Because we need that compute for our React frameworks.
Don't forget Electron as well.
Cracking a 512-bit DKIM key for less than $8 in the cloud
91–100 of 433 posts
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#92Some DNS providers suck and only let you set 1024 bit long keys. For example wordpress.com.
RSA-1024 seems to be about 8 million times better than RSA-512, so cracking that would be $64 million in compute. Not NSA-proof, but should be more than enough to keep spammers out, especially considering that DKIM is just one layer of protection.
512 extra bits of key only gets you 23 bits of entropy?
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#93CADO-NFS makes this surprisingly easy to do. A few weeks back I factored a 512bit RSA DKIM key for work using my desktop computer in only 28 hours. Specifically, an AMD Zen 5 9900X.
Unfortunately 1024 bit keys are still out of reach of a hobbyist effort but could be pulled off by academics roughly of the same scale as the 2010 effort to factor a 768 bit key (https://eprint.iacr.org/2010/006.pdf)
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#94Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time measure. Compute is rapidly increasing, there is continuous chatter about quantum and yet everyone seems to be just staring at their belly buttons. Obviously bigger keys are more expensive in compute, but we've got more too...why only use it on the cracking sid…
The key sizes we use today are expected to hold against a Dyson sphere focused on breaking them with the best exploit we know today. What size do you suggest?
It's not quantum-safe though.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#95Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time measure. Compute is rapidly increasing, there is continuous chatter about quantum and yet everyone seems to be just staring at their belly buttons. Obviously bigger keys are more expensive in compute, but we've got more too...why only use it on the cracking sid…
We are. 1024-bit keys are being retired across cryptosystems everywhere, and have been for over a decade (don't get me started on the one laggard). Nothing threatens 2048 bit keys other than QC, which threatens RSA altogether. Progress isn't linear; it's not like 2048 falls mechanically some time after 1024 (which itself is not practical to attack today).
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#96Earlier quoted context omitted.
> Probably because RSA 2048 is not yet broken […] 3072 has been recommended by various parties for a few years now: * https://www.keylength.com
RSA 2048 isn't broken, but experts consider it a matter of time. How long I don't know, but since the attacks are known (prime numbers) someone (read not me) can make an estimate with error bars that are concerning enough to consider it as good as broken.
What expert considers it a matter of time before 2048 is broken? 2048 is 112-bit-equivalent security.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#97Earlier quoted context omitted.
When using deniable authentication (e.g. Diffie-Hellman plus a MAC), the recipient can verify that the email came from the sender. But they can't prove to a third party that the email came from the sender, and wasn't forged by the recipient.
Mallory sends a message, forged as if from Alice, to Bob. How can Bob determine that it came from Alice and wasn’t forged by Mallory?
This is always a possibility but I'm guessing the happy path is the more likely believable scenario and could be verified OOB.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#98Some DNS providers suck and only let you set 1024 bit long keys. For example wordpress.com.
Yikes. NIST wants to forbid even 2048-bit RSA by 2035, because it doesn't offer a good enough security level.
2048 achieves the same security level NIST requires from AEADs, doesn't it? What plausibly attacks it? Pushing people past 2048 seems counterproductive.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#99In case anybody is wondering about whether the 512bit number is big or small it depends on whether it is symmetric or asymmetric encryption technique. Always presume asymmetric encryption is 8x weaker than symmetric encryption.
DKIM is asymmetric. So a 512bit DKIM equivalent symmetric hash would be 64bits, which is long broken. Even 160bit SHA1 is considered broken. A DKIM of roughly equivalent strength to a 512bit SHA3 would be at least 4096bits and still does not include SHA3's techniques for mitigating replay attacks.
Re: Cracking a 512-bit DKIM key for less than $8 in the cloud
#100Some DNS providers suck and only let you set 1024 bit long keys. For example wordpress.com.
1024 is still many orders of magnitude hard to crack than 512. For the record, the last RSA number having been broken was RSA-250 (829 bits) and it took 2700 core-years to crack back in 2020[1]. In comparison, RSA-155 (512 bits) was factorized as early as 1999! You aren't in danger. [1]: https://sympa.inria.fr/sympa/arc/cado-nfs/2020-02/msg00001.h...
There are several open source GNFS tools that can do 1024 very efficiently on GPUs, and even cheap consumer GPUs have 10s of thousands of cores now, even by your measure "2700 core-years" is only around a month or so on a single consumer grade GPU.
Not "free", but any malicious actor has access to a lot more than a single GPU.
The UK government also has several huge arm based solutions dedicated to cracking internet encryption, zero chance that isn't breaking mostly everything, for sure the Chinese and Russians have similar.