Derek Atkins <warlord@MIT.EDU> writes:
You are right... Given talks Ive had with Brian LaMacchia, who broke a version of "Secure SunRPC" (a 192-bit prime), he claims that the difficulty is reducing a D-L problem is about the same amount of computation to factorize an RSA modulus of approximately the same size..
Although DH and RSA are believed to be of approximately equal difficulty given the same number of bits, DH is additionally vulnerable because system designers usually publish an "official" modulus and primitive root for everyone to use, whereas in RSA, everyone has their own key. To mount an attack on PGP, for instance, you must factor a key for each person whose privacy you wish to compromise. Breaking Sun's published 192 bit DH modulus instantly broke SunRPC on all machines using the protocol. The latter was a lot less work than the former. -- Mike Duvos $ PGP 2.6 Public Key available $ mpd@netcom.com $ via Finger. $