Researcher finds RSA 1024-bit encryption not enough

The strength of the encryption now used to protect banking and e-commerce transactions on many websites may not be effective in as few as five years, a cryptography expert has warned after completing a new distributed-computing project.

Arjen Lenstra, a cryptology professor at the Ecole Polytechnique Fédérale de Lausanne (EPFL) in Switzerland, says the distributed computation project, conducted over 11 months, achieved the equivalent in difficulty of cracking a 700-bit RSA encryption key, so it doesn’t mean transactions are at risk — yet.

But “it is good advanced warning” of the coming dusk of 1024-bit RSA encryption — which is widely used now for internet commerce — as computers and mathematical techniques become more powerful, Lenstra says.