FAQ change, final draft

Robert J. Hansen rjh at sixdemonbag.org
Tue Aug 12 22:02:21 CEST 2014

> logarithmically in key strength. So yes, a switch to ECC would be equivalent to
> much larger RSA keys. I'm not sure, but didn't discrete-logarithm keys scale
> roughly equivalently to RSA? I think so, but I'm not sure...

Yes.  The general consensus is that the discrete logarithm problem is 
harder than integer factorization, so ELG/DSA will provide more strength 
than RSA for a given length.

However, I've also been cautioned by some big names in crypto that I 
shouldn't put too much stock in this: we know DLP must be at least as 
hard as integer factorization, but we don't have precise numbers for how 
much harder it has to be, and the tendency over the years has been for 
the two to slowly converge in difficulty.

As of now the best guidance is to think DLP is at least as hard as IFP, 
but to be skeptical about how much harder.

More information about the Gnupg-users mailing list