GPG Long Key Length Messages

Anonymous anonymous at anonymizer.com
Thu Apr 18 21:11:01 CEST 2002


When generating a 4096 bit key, gpg notes:
> Keysizes larger than 2048 are not suggested because computations take
> REALLY long!
> Are you sure that you want this keysize?

This message needlessly alarms users.  A more accurate and useful
message would be:
> Keysizes larger than 2048 take a relatively long time to generate.
> However, when used they are only slightly slower than shorter key
> sizes.  On modern hardware, generating a 4096 bit key will take less
> than twenty minutes.
> Do you still want to generate this key?

If the user wants to generate the key, gpg then says:
> Okay, but keep in mind that your monitor and keyboard radiation is
> also very vulnerable to attacks!

Users should not be discouraged from using longer key sizes if they
want to.  This message also gives the impression that tempest attacks
apply to the same threat models as easy factoring.  They do not.  A
tempest attack cannot be mounted years later and thousands of miles
away.





More information about the Gnupg-devel mailing list