This Blog Is Not For Reading

A blog, just like any blog, only more so

  • Subscribe

  • Categories

  • RSS Bob Jonkman’s Microblog

    • New note by bobjonkman 3 October 2020
      There's also Megablocks, the precursor to Duplo. And there are also Micro Megablocks, the same size as LEGO. The kits for Micro Megablocks were much better than the LEGO kits, making slightly larger models but using only standard bricks. The LEGO models were smaller, depending on many custom pieces specific to the kit, which were […]
    • Favorite 3 October 2020
      bobjonkman favorited something by clacke: Not only are Duplo blocks *like* Lego blocks, they *are* Lego blocks, and I don't just mean that Duplo is a Lego brand and produced in the same factory, the two systems are actually compatible.A Lego 2x2 block fits and sticks to the underside of a Duplo block, and the […]
    • bobjonkman repeated a notice by clacke 3 October 2020
      RT @clacke Not only are Duplo blocks *like* Lego blocks, they *are* Lego blocks, and I don't just mean that Duplo is a Lego brand and produced in the same factory, the two systems are actually compatible. A Lego 2x2 block fits and sticks to the underside of a Duplo block, and the nob on […]
    • Favorite 27 September 2020
      bobjonkman favorited something by clacke: > At least as far as we’re aware, however, this is the first time that a pirated copy of a movie has actually been shown at a cinema in the United States. And surely, it must be the first instance where a pirated copy has been obtained from a torrent […]
    • bobjonkman repeated a notice by tobias 27 September 2020
      RT @tobias ♲ @frederic: "Starting this Thanksgiving I am going to write a complete Unix-compatible software system called GNU (for Gnu's Not Unix), and give it away free to everyone who can use it." September 27, 1983 - Richard Stallman. www.gnu.org/gnu/initial-announ… Happy birthday to GNU \0/
    • Favorite 27 September 2020
      bobjonkman favorited something by tobias: ♲ @frederic@pouet.couchet.org: "Starting this Thanksgiving I am going to write a complete Unix-compatible software system called GNU (for Gnu's Not Unix), and give it away free to everyone who can use it." September 27, 1983 - Richard Stallman. www.gnu.org/gnu/initial-announ…Happy birthday to GNU \0/
    • bobjonkman repeated a notice by lxoliva 27 September 2020
      RT @lxoliva happy original software freedom day! on this day, 37 years ago, Richard Stallman launched the Free Software Movement, and the GNU Project, to build a user-freedom-respecting operating system, so that all users could do their computing in freedom
    • Favorite 27 September 2020
      bobjonkman favorited something by lxoliva: happy original software freedom day! on this day, 37 years ago, Richard Stallman launched the Free Software Movement, and the GNU Project, to build a user-freedom-respecting operating system, so that all users could do their computing in freedom
    • New note by bobjonkman 22 September 2020
      In the Netherlands (which the Dutch call "Nederland") the language is called "Nederlands", so that makes sense. Perhaps English speakers couldn't differentiate between "Nederlands" and "Deutsch", which corrupted to "Dutch". And why do we call the country "Germany" and the inhabitants "Germans" when they call their country "Deutschland" and themselves "die Deutsche"?
    • Favorite 29 August 2020
      bobjonkman favorited something by eloquence: Disturbing reports that Google Play is threatening to kick out Mastodon apps. See:https://mastodon.social/@Gargron/104763960269049818https://toot.fedilab.app/@fedilab/104765191594914330App stores have a track record of acting capriciously & are also easy targets for gov't censors (including Trump). This is why alternatives like @fdroidorg are so important for user freedom.If unfamiliar: F-Droid is a free & open […]

The cost of long GnuPG/PGP keys

Posted by Bob Jonkman on 25th March 2014

Never Eat That Green Food At The Back Of The Fridge

Never Trust Anyone Over Thirty

and

Never Sign A GnuPG/PGP Key That’s Older Than You Are

Face peeking into fridge

Looking for green food at the back of the fridge

OK, only one of those is true, and it’s not the last one. At the University of Waterloo Keysigning Party last fall, some of the people signing my key were younger than the key they were signing!

At the keysigning I was having a discussion with someone about key lengths. In particular, choosing 4096 bits instead of 2048. I was reading that GnuPG has a limit of 4096 bits, but that 4096 should be enough for all time to come.

I’ve read online that GnuPG does actually support larger key sizes but that there is a const in the source code limiting it to 4096. The reasons for doing so are supposedly speed, 4096 would be very slow to generate and use, and comparability with other implementations that may not support larger keys. Personally I think it’s an inevitability that this will be increased in time but we’re not there yet.

In 1996 when I started with PGP a 1024 bit key was considered adequate, by 1999 a 2048 bit key was still considered large.

Consider Moore’s Law: every 18 months computing capacity doubles and costs halve. I’m not sure if that means that over 18 months x flops increases to 2x flops at the same price, or that in 18 months the cost of x flops is half of today’s cost, or if it means that in 18 months the cost of 2x flops will be half the cost of x flops today. If the latter, then today’s x flops/$ is x/4 flops/$ in 18 months. That factor of four is an increase of two bits every 18 months, or four bits every 3 years.

So, the cost in 1996 to brute-force crack a 1024 bit key is the same as the cost in 1999 to crack a 1028 bit key. And in 2014, 18 years later, it’s the same cost as cracking a 1048 bit key (an additional 24 bits).

An increase in key size from 1024 bits to 2048 bits buys an additional 768 years of Moore’s Law. And going from 2048 bits to 4096 bits buys an additional 1536 years of Moore’s Law.

Is Moore’s Law overestimating the cost of cracking keys? Are there fundamental advances in math that have dropped the cost of cracking 1024 bit keys to near-zero? What’s the economic justification for crippling keysizes in GnuPG, anyway?

–Bob, who is not trolling but really wants to know.

Day 57 / 365 – refrigerator by Jason Rogers is used under a CC BYCC BY license.

This post is based on a message to the KWCrypto Mailing List.

Tags: , , , , , , , , ,
Posted in Crypto, PGP/GPG | 1 Comment »

 
Better Tag Cloud