Hacker News Reader

Comment by pbsd | Hacker News Reader

The more important point to take away from this paper is not that 1024-bit is already considered broken, so this doesn't matter. It's that the cost of 2048-bit DH---which is used and recommended today, and will stick around forever---has roughly the cost of 1024-bit DH when coupled with a special polynomial.

View on HN

So I'm clear, you're referring here to the bit from the "Lessons" section at the end of the paper?

I didn't realize that was in there, but yes.

I guess another thing to take away from this is that the logistics of actually deploying a SIGINT infrastructure based on breaking 1024-bit DH needs to take into account that a university can break a single dlog in 80 minutes (and so the NSA's hypothetical Utah data center can probably do it in under a minute) if you can get SNFS-weakened parameters deployed.

That takes attacks against 1024 bit DH from a "special order, only for high value target" sort of thing to a "file a ticket and wait a few minutes" kind of thing.

According to the Logjam paper, the 1024-bit individual logarithm would cost around 30 (parallelizable) core-days once the group precomputation is over with. Unless they're being exceedingly stingy with their hardware, 30 core-days (less than a day in a single powerful workstation) would already be 'file a ticket' levels of easy.

(Note that the time reported in this newer paper is calendar time---it's still 10 core-days, so quite comparable to the non-special variant.)

Reply on news.ycombinator.com