Factorisation and Discrete Logs

[Mike Duvos]

Derek Atkins <warlord at MIT.EDU> writes:

 > You are right...  Given talks Ive had with Brian LaMacchia,
 > who broke a version of "Secure SunRPC" (a 192-bit prime), he
 > claims that the difficulty is reducing a D-L problem is
 > about the same amount of computation to factorize an RSA
 > modulus of approximately the same size..

Although DH and RSA are believed to be of approximately equal
difficulty given the same number of bits, DH is additionally
vulnerable because system designers usually publish an "official"
modulus and primitive root for everyone to use, whereas in RSA,
everyone has their own key.

To mount an attack on PGP, for instance, you must factor a key
for each person whose privacy you wish to compromise.  Breaking
Sun's published 192 bit DH modulus instantly broke SunRPC on all
machines using the protocol.  The latter was a lot less work than 
the former.

-- 
     Mike Duvos         $    PGP 2.6 Public Key available     $
     mpd at netcom.com     $    via Finger.                      $