From: uri@watson.ibm.com
Date: Mon, 29 Mar 93 06:16:49 PST
To: mccoy@ccwf.cc.utexas.edu (Jim McCoy)
Subject: Re: PGP Secure?
In-Reply-To: <9303290550.AA41108@acs.bu.edu>
Message-ID: <9303291700.AA17161@buoy.watson.ibm.com>
MIME-Version: 1.0
Content-Type: text/plain


Jim McCoy writes:
 > > Given a brute force attack on ciphertext encrypted with PGP2.2
                         ^^^^^^^^^^^^^^^^^^^^
 > > using the 1024 bit key, how many operations are required to
 > > hit on the session key...?
 > 	-If you did 1000 attempts to break a 1024 bit RSA key every second
 > 	and started your calculations at the beginning of the universe, you
 > 	would still have several trillion years to go.
 > 	-If you stored every attempted key in a single atom, you would run
 > 	out of atoms in the universe long before you ran out of keys.

Well, of course one doesn't have to break RSA to get the _session_ key,
it would be enough to break IDEA, which will automatically deliver
the key to you along with the cleartext. Again of course, it's
not obvious, why one might want that session key (:-).

 > What it boils down to is that anyone who tried a brute-force attack on your
 > RSA key is either very stupid or hopes to be very lucky.  (very, very, very
 > lucky)  .............

Sure... How about one, who simply knows how to improve
brute-force key-search attack on IDEA?  A possibility? (:-)

Regards,
Uri.
------------
<Disclaimer>