Factorization of a 768-bit RSA modulus

Daniel Kahn Gillmor dkg at fifthhorseman.net
Wed Jan 21 15:05:46 AEDT 2015

On Thu 2015-01-08 09:15:20 -0500, Fedor Brunner wrote:
> ssh-keygen.c contains condition
>      else if (type != KEY_ECDSA && type != KEY_ED25519 && *bitsp < 768)
>              fatal("Key must at least be 768 bits");
> Please increase the minimal RSA key length.
> https://eprint.iacr.org/2010/006
> This paper reports on the factorization of the 768-bit number RSA-768 by
> the number field sieve factoring method

This seems to still be the case:


a minimum of 1024 bits would still be low, but it would be better than

Arguably, modern SSH clients and servers shouldn't even accept 768-bit
keys, let alone generate them.

Is there interest upstream in raising this floor?


More information about the openssh-unix-dev mailing list