Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite
1

If one has been using the same set of public-private key pair for quite sometime now, given his public key(which is public), can't an attacker find the corresponding private key for that public key by bruteforce?
If not bruteforce then what else methods are there to break the rsa encryption?

share|improve this question
2  
For 128bit, at 1 attempt per nanosecond, it will take 11,342,745,564,031,282,115,445 years to try all keys. You're bruteforce safe. – Chuck Fricano Mar 30 '12 at 6:52
1  
@ChuckFricano, 128 bits tend to be for symmetric keys, not RSA (asymmetric) keys. That's not quite the same problem. – Bruno Mar 30 '12 at 10:23
What key size are you using? – mikeazo Apr 1 '12 at 13:08
@mikeazo : 2048 – Ashwin Apr 1 '12 at 16:59
@user1139023 - So your key size is larger then the number of stars in the galaxy and your asking if its safe? Its currently safe, eventually change it to a larger key size, always good to do that. – Ramhound Apr 3 '12 at 11:47

migrated from stackoverflow.com Apr 1 '12 at 3:54

3 Answers

up vote 1 down vote accepted

They can, but bruteforceing these keys takes too much time to actually be a plausible attack. This depends on things like key length, but in general we are talking about on the order of thousands of years (or more!) to bruteforce. And as far as I know, RSA keys aren't subject to key wear, so using a public-private key for a while won't help attackers discover the private key.

share|improve this answer
Thanks for answering. But if not bruteforce then what other method is there to break rsa. – Ashwin Mar 30 '12 at 7:04
If RSA is implemented correctly, brute-force is the best you can do in attempting to break RSA. However, if RSA is implemented poorly, there are several attacks you can execute. For example, if the algorithm chooses primes too close to each other, or the primes are too small, you can break RSA more easily. This is why you should never implement things like this yourself, and use a trusted library. – Oleksi Mar 30 '12 at 7:10
up vote 1 down vote

If the attacker has discovered the solution to the RSA problem, they are probably too busy heading to the bank to worry about whats on the other end of the line.

http://en.wikipedia.org/wiki/RSA_problem

share|improve this answer
up vote -1 down vote

Like all credential schemes, RSA is easily cracked by not being cracked but by doing an end run around it. If you realtime your malware to boost the entered key out to an IRC channel or other type of IM, you have about 30 seconds to steal both factors and use them to break an account. The major defense becomes keeping the computer used to do the login operation clean of all malware.

share|improve this answer
Yep, people hate it when their fancy, expensive playtoys get shown to be avoidable. The OP asked if there was a way, and this kind of exploit is out there. – Fiasco Labs Apr 1 '12 at 14:43
This isn't "cracking RSA" its just observing the (unencrypted) private key. IRC/IM/30sec limit has nothing to do with it. If you have malware running on the same system (with appropriate access controls) as the private key at any point you can copy the private key (and transfer it via any method IM/IRC/SCP/FTP/HTTP/Email/blog post/etc.), and use it to authenticate in to the remote system. Yes, if its password/passphrase protected secret key the malware will either have to keylog the password/passphrase or find the decrypted private key from memory when its used. – dr jimbob Apr 1 '12 at 22:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.