Researcher: RSA 1024-bit encryption not enough

Encryption used now to protect banking and e-commerce transactions on many Web sites may not be effective in as few as five years

The strength of the encryption used now to protect banking and e-commerce transactions on many Web sites may not be effective in as few as five years, a cryptography expert has warned after completing a new distributing-computing achievement.

Arjen Lenstra, a cryptology professor at the Ecole Polytechnique Federale de Lausanne (EPFL) in Switzerland, said the distributed computation project, conducted over 11 months, achieved the equivalent in difficulty of cracking a 700-bit RSA encryption key, so it doesn't mean transactions are at risk -- yet.

But "it is good advanced warning" of the coming dusk of 1024-bit RSA encryption, widely used now for Internet commerce, as computers and mathematical techniques become more powerful, Lenstra said.

The RSA encryption algorithm uses a system of public and private keys to encrypt and decrypt messages. The public key is calculated by multiplying two very large prime numbers. Prime numbers are divisible only by "1" and themselves: For example, "2" and "3" and "7" are prime.

By identifying the two prime numbers used to create someone's public key, it's possible to calculate that person's private key and decrypt messages. But determining the prime numbers that make up a huge integer is nearly impossible without lots of computers and lots of time.

Computer science researchers, however, have plenty of both.

Using between 300 and 400 off-the-shelf laptop and desktop computers at EPFL, the University of Bonn and Nippon Telegraph and Telephone Corp. in Japan, researchers factored a 307-digit number into two prime numbers. Factoring is the term to break a number down into prime numbers. For example, factoring the number 12 would give 2 x 2 x 3.

Lenstra said they carefully selected a 307-digit number whose properties would make it easier to factor than other large numbers: that number was 2 to the 1039th power minus 1.

Still, the calculations took 11 months, with the computers using special mathematical formulas created by researchers to calculate the prime numbers, Lenstra said.

Even with all that work, the researchers would only be able to read a message encrypted with a key made from the 307-digit number they factored. But systems using the RSA encryption algorithm assign different keys to each user, and to break those keys, the process of calculating prime numbers would have to be repeated.

The ability to calculate the prime number components of the current RSA 1024-bit public keys remains five to 10 years away, Lenstra said. Those numbers are typically generated by multiplying two prime numbers with around 150 digits each and are harder to factor than Lenstra's 307-digit number.

The next target for Lenstra is factoring RSA 768-bit and eventually 1024-bit numbers. But even before those milestones are met, Web sites should be looking toward stronger encryption than RSA 1024-bit.

"It is about time to change," Lenstra said.

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?