views:

251

answers:

3

I know, there are a lot of limitations to the length of used key (import and export limitations for nearly each country). Usually, it varies from 64 to 256 bits. To use more bits, it is obligatory to ask permission from authorities.

But it is recommended to use 1024 bits keys for RSA as minimum! Does it mean that I cannot just use RSA without any problems with law and so on?

+2  A: 

Bit length restrictions in the 64 bit range are implicitly relating to symmetric crypto. There are usually separate bit length restrictions for asymmetric crypto like RSA (for example, the 1998 relaxation of export controls in the US allowed export of symmetric crypto of up to 56 bits and asymmetric crypto of up to 1024 bits).

64 bit RSA encryption would be breakable in minutes less than a second.

caf
Actually, a 64-bit RSA key would be breakable in a fraction of a second. Also, since the PKCS#1 padding mandates adding at least 11 bytes to the plaintext before encrypting, a 64-bit RSA key would be unusable as well. A 128-bit RSA key (still breakables in a matter of seconds) could encrypt messages up to 40 bits.
Thomas Pornin
@Thomas Pornin: I figured as much, but I didn't want to oversell it - I think the point is made, anyway. 512 bit RSA keys have been cracked in the real world (eg TIs calculator firmware signing keys); in contrast distributed.net has been working on a single 72 bit RC5 symmetric key for more than 7 years now.
caf
For the record: the current record in RSA key cracking is 768 bits; it took four years with big computers and bigger scientist brains.
Thomas Pornin
A: 

In Special Publication 800-57 NIST recommends that 1024-bit RSA keys only be used to protect data until 2010.

bignum
A: 

I am not a lawyer (IANAL), but if your application uses an external library or built-in OS service, US export restrictions on cryptography do not require an in depth review of your code and algorithms. The MSCrypto library that ships with the Windows OS has been signed off by the Feds for export (though its capabilities may be limited in some geopolitical regions), so apps that use the MSCrypto DLL functions don't have to go through an exhaustive review.

I've been part of the release cycle of several retail products that used MSCrypto to generate keys and encrypt/decrypt data, and the most we had to do to satisfy the US export restrictions was fill out a form that declared that we used MSCrypto, the key sizes we used, and for what purpose.

If you implement a crypto algorithm on your own, or you statically link crypto code into your exe or dll (not a separate DLL), and your software will be sold outside the US (doesn't have to be sold by you), you will likely be required to submit to an in depth review of your code and/or algorithms in order to get an export waiver.

dthorpe