RSA keys with the size of 1024 aren’t considered to be safe anymore. Does this also apply if you use this key for signing only? Can a signature be faked easily with a short key length?


When RSA keys are too small, the private key can be derived from the public key. This means the attacker doesn't even need to have access to a signature created by the private key, all he needs is the public key. It doesn't matter if the key is used for encryption, signatures, both, or nothing at all.

The current largest RSA key known to be broken is 768 bits, but governments and organizations with large amounts of computing power may be able to factor a 1024 bit key in the near future (perhaps even today), so 2048 bit keys are generally recommended now.

| improve this answer | |
  • 1
    The current largest RSA key known to be broken is 768 bits: citation needed. Adding a reference would really improve your answer. – ThoriumBR Jan 15 '19 at 18:14

The reason 1024-bit RSA keys are considered weak is because it is near-trivial for an attacker to derive the private key if they know the public key. Even if the key is only used for signing, as in the case you describe, the attacker would be able to forge valid signatures if they know the public key used to make them.

| improve this answer | |
  • It's not "near-trivial", and I don't believe it's even been publicly accomplished yet. – AndrolGenhald Jan 15 '19 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.