FAQ change, final draft
Robert J. Hansen
rjh at sixdemonbag.org
Tue Aug 12 22:02:21 CEST 2014
> logarithmically in key strength. So yes, a switch to ECC would be equivalent to
> much larger RSA keys. I'm not sure, but didn't discrete-logarithm keys scale
> roughly equivalently to RSA? I think so, but I'm not sure...
Yes. The general consensus is that the discrete logarithm problem is
harder than integer factorization, so ELG/DSA will provide more strength
than RSA for a given length.
However, I've also been cautioned by some big names in crypto that I
shouldn't put too much stock in this: we know DLP must be at least as
hard as integer factorization, but we don't have precise numbers for how
much harder it has to be, and the tendency over the years has been for
the two to slowly converge in difficulty.
As of now the best guidance is to think DLP is at least as hard as IFP,
but to be skeptical about how much harder.
More information about the Gnupg-users