logarithmically in key strength. So yes, a switch to ECC would be equivalent to much larger RSA keys. I'm not sure, but didn't discrete-logarithm keys scale roughly equivalently to RSA? I think so, but I'm not sure...
Yes. The general consensus is that the discrete logarithm problem is harder than integer factorization, so ELG/DSA will provide more strength than RSA for a given length.
However, I've also been cautioned by some big names in crypto that I shouldn't put too much stock in this: we know DLP must be at least as hard as integer factorization, but we don't have precise numbers for how much harder it has to be, and the tendency over the years has been for the two to slowly converge in difficulty.
As of now the best guidance is to think DLP is at least as hard as IFP, but to be skeptical about how much harder.
_______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users
