Let's say I am using a RSA keypair to encrypt and decrypt a large amount of traffic over a public network. Assume all traffic is padded and the key is 2048 bits, how often would you recommend renewing the private key?

Is there a mathematical solution to how much encrypted data is needed in bytes that would allow a hacker to calculate the private key?

A real life example of this might be a messaging service which encrypts all traffic with one key.

  • 1
    See here, which states "In 2009 the 768 bit number rsa-768 was cracked using about 1000 cores and 2 years of calculations. Assuming they used the General number field sieve (a very fair assumption) it would take them 7481 years to crack a 1024 bit number using the same hardware." – Robert Harvey Jan 13 '17 at 17:16
  • @RobertHarvey: So... renew every 7000 years, just to be safe? ;) – FrustratedWithFormsDesigner Jan 13 '17 at 17:39
  • 2
    Something like that. 2048 bits is probably closer to "heat death of the universe." – Robert Harvey Jan 13 '17 at 17:39
  • @RobertHarvey assuming that particular configuration. If you increase the computational power involved you can reduce the time to break the key. Other aspects have to be considered like a leak of your keystore. – linuxunil Jan 13 '17 at 17:52
  • 5
    I think this should be migrated to Information Security. – JimmyJames Jan 13 '17 at 21:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.