3

If one has been using the same set of public-private key pair for quite sometime now, given his public key(which is public), can't an attacker find the corresponding private key for that public key by bruteforce?
If not bruteforce then what else methods are there to break the rsa encryption?

Improve this question
5
  • 2
    For 128bit, at 1 attempt per nanosecond, it will take 11,342,745,564,031,282,115,445 years to try all keys. You're bruteforce safe.
    – Chuck Fricano
    Commented Mar 30, 2012 at 6:52
  • 1
    @ChuckFricano, 128 bits tend to be for symmetric keys, not RSA (asymmetric) keys. That's not quite the same problem.
    – Bruno
    Commented Mar 30, 2012 at 10:23
  • What key size are you using?
    – mikeazo
    Commented Apr 1, 2012 at 13:08
  • @mikeazo : 2048
    – Ashwin
    Commented Apr 1, 2012 at 16:59
  • @user1139023 - So your key size is larger then the number of stars in the galaxy and your asking if its safe? Its currently safe, eventually change it to a larger key size, always good to do that.
    – Ramhound
    Commented Apr 3, 2012 at 11:47

3 Answers 3

Reset to default
3

They can, but bruteforceing these keys takes too much time to actually be a plausible attack. This depends on things like key length, but in general we are talking about on the order of thousands of years (or more!) to bruteforce. And as far as I know, RSA keys aren't subject to key wear, so using a public-private key for a while won't help attackers discover the private key.

Improve this answer
2
  • Thanks for answering. But if not bruteforce then what other method is there to break rsa.
    – Ashwin
    Commented Mar 30, 2012 at 7:04
  • If RSA is implemented correctly, brute-force is the best you can do in attempting to break RSA. However, if RSA is implemented poorly, there are several attacks you can execute. For example, if the algorithm chooses primes too close to each other, or the primes are too small, you can break RSA more easily. This is why you should never implement things like this yourself, and use a trusted library.
    – Oleksi
    Commented Mar 30, 2012 at 7:10
1

If the attacker has discovered the solution to the RSA problem, they are probably too busy heading to the bank to worry about whats on the other end of the line.

http://en.wikipedia.org/wiki/RSA_problem

Improve this answer
-1

Like all credential schemes, RSA is easily cracked by not being cracked but by doing an end run around it. If you realtime your malware to boost the entered key out to an IRC channel or other type of IM, you have about 30 seconds to steal both factors and use them to break an account. The major defense becomes keeping the computer used to do the login operation clean of all malware.

Improve this answer
2
  • Yep, people hate it when their fancy, expensive playtoys get shown to be avoidable. The OP asked if there was a way, and this kind of exploit is out there.
    – Fiasco Labs
    Commented Apr 1, 2012 at 14:43
  • 1
    This isn't "cracking RSA" its just observing the (unencrypted) private key. IRC/IM/30sec limit has nothing to do with it. If you have malware running on the same system (with appropriate access controls) as the private key at any point you can copy the private key (and transfer it via any method IM/IRC/SCP/FTP/HTTP/Email/blog post/etc.), and use it to authenticate in to the remote system. Yes, if its password/passphrase protected secret key the malware will either have to keylog the password/passphrase or find the decrypted private key from memory when its used.
    – dr jimbob
    Commented Apr 1, 2012 at 22:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .