RSA解密时间问题

   RSA加密算法是Ron Rivest、Adi Shamir和Leonard Adleman提出的一种公开密钥加密算法，使用一对公钥和私钥（依靠大质数生成）对信息加密，常被用于数字签名。 RSA算法的破解与密钥的长度有关，最常见的破解方法是因式分解，如果密钥的长度小于等于256位，一台较快的电脑可以在几个小时内成功分解其因子。位数越高因式分解所需时间也越长。1999年，一台Cray超级电脑用了5个月时间分解了512位长的密钥。而目前典型密钥长度是1028位。在512位RSA算法破解10年之后，一群研究人员报告(PDF)他们因式分解了768位RSA算法。他们是在2009年12月9日分解了768位、232数位数字的RSA-768密钥。分解一个768位RSA密钥所需时间是512位的数千倍，而1024位所需时间则是768位的一千多倍，因此在短时间内1024位仍然是安全的。研究人员表示1024位密钥预计也将会在10年内攻破，因此在未来三到四年内应逐步淘汰1024位RSA密钥。

就目前的计算能力来说破解1024位密钥至少也需要两年时间，而破解2048位密钥起码需要80年。

下面是关于相已被破解的位长加密的信息

General Purpose Factoring Records

---

Below is a chart of general purpose factoring records going back to 1990. By "general purpose", we mean a factoring algorithms whose running time is dependent upon only the size of the number being factored (i.e. not on the size of the prime factors or any particular form of the number).

Sieving is typically the dominant factorization run time in practice. All sieving times below are approximate. Early versions of factoring records estimated time in MIPS years, which is the number of years it would take a computer that operates at one million instructions per second to factor the number. More recently, almost everybody uses Pentiums or AMDs. Thus, we scale some timings to Pentium 1GHz CPU years: the number of years it would take a 1GHz Pentium (or AMD) to complete sieving.

number	digits	date completed	sieving time	algorithm
C116	116	1990	275 MIPS years	mpqs
RSA-120	120	June, 1993	830 MIPS years	mpqs
RSA-129	129	April, 1994	5000 MIPS years	mpqs
RSA-130	130	April, 1996	1000 MIPS years	gnfs
RSA-140	140	February, 1999	2000 MIPS years	gnfs
RSA-155	155	August, 1999	8000 MIPS years	gnfs
C158	158	January, 2002	3.4 Pentium 1GHz CPU years	gnfs
RSA-160	160	March, 2003	2.7 Pentium 1GHz CPU years	gnfs
RSA-576	174	December, 2003	13.2 Pentium 1GHz CPU years	gnfs
C176	176	May, 2005	48.6 Pentium 1GHz CPU years	gnfs
RSA-200	200	May, 2005	121 Pentium 1GHz CPU years[*]	gnfs
RSA-768	232	Dec, 2009	3,300 Opteron 1GHz CPU years[**]	gnfs

[*] In regard to RSA-200, Thorsten Kleinjung writes: we spend 25% of the total time for the matrix step. If one considers the total time we spent about 170 CPU years.

[**] In regard to RSA-768, they sieved twice as much as needed in order to make the matrix more manageable. The matrix time took about one tenth of the sieving time. The total time for the factorization was estimated to be about 4,400 Opteron 1GHz years.

For more factorization results, please see the Factorization Announcements page or Paul Zimmermann's Factor Records page.