<p>Actually, RSA is broken. The Fasterfactor algorithm, is a high speed factorization for very large numbers:</p>

<p><a href="https://i.sstatic.net/ZZ4Se.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/ZZ4Se.png" alt="enter image description here"></a></p>

CC BY-SA 3.0
2017-12-07T23:30:40.637Z
If RSA was broken, I think I'd have heard about it somewhere, probably on the front page of the New York Times or something.
Mark
CC BY-SA 3.0
2017-12-08T02:29:41.710Z
Citation needed!  If this is your own proposed novel attack, then this is not the place to share it.  People will probably not take it seriously until you have released code, cracked well-known challenge messages, or published your attack in a peer-reviewed journal.  Your image doesn't seem to contain anything beyond simple algebra and I would bet a lot that the idea has already been considered and shown not to be significant.
Nate Eldredge
CC BY-SA 3.0
2017-12-07T15:14:22.840Z
2017-12-07T19:58:25.243Z
2017-12-07T19:58:25.243Z
ted mann
<p>Now with vulnerability found in RSA it looks like a good choice… then in the past
<a href="https://crocs.fi.muni.cz/public/papers/rsa_ccs17" rel="nofollow noreferrer">https://crocs.fi.muni.cz/public/papers/rsa_ccs17</a> .
With Amazon AWS  (Intel E5-2650 v3@3GHz) you can crack 512bit RSA key proximately in 2 hours.</p>

CC BY-SA 3.0
2017-10-18T15:38:22.370Z
This is not a vulnerability in RSA itself but rather in the way that a certain cryptographic library generates RSA keys. Keys not generated with this library are not vulnerable. Shorter keys (keys with length less than 2048 bits) are generally considered insecure anyways.
Ava Chow
CC BY-SA 3.0
2017-10-18T12:25:05.973Z
2017-10-18T12:33:22.437Z
2017-10-18T12:33:22.437Z
iiic
<p>I'm not sure why you think RSA is <em>much safer</em> than ECDSA. As you can read here: <a href="https://crypto.stackexchange.com/questions/3216/signatures-rsa-compared-to-ecdsa">https://crypto.stackexchange.com/questions/3216/signatures-rsa-compared-to-ecdsa</a> </p>

<p>ECDSA offers same levels of security as RSA, but with a much smaller footprint. </p>

<p>In fact, the more you increase the security, the larger the RSA keys become compared to ECDSA.  This makes RSA less fit for a system such as bitcoin which requires small packets to be sent around the network all the time (being peer-to-peer).</p>

CC BY-SA 3.0
2014-01-28T12:49:41.203Z
I didn't claim RSA was _safer_, merely that it apparently can be implemented more easily on smartcards. The smaller footprint is a severe reason though, due to the blockchain containing all signatures ever made
Tobias Kienzler
CC BY-SA 3.0
2014-01-28T12:55:36.343Z
As far as I can tell you claim that RSA is safer, compared to ECSDA, because it doesn't require a good RNG. Not sure this claim is proven in the link you posted.
Luca Matteis
CC BY-SA 3.0
2014-01-28T12:57:51.987Z
Oh, that was badly phrased, sorry - I merely wanted to use that as a transition on why there appear to exist no ECDSA smartcards
Tobias Kienzler
CC BY-SA 3.0
2014-01-28T12:43:30.070Z
2014-01-28T12:43:30.070Z
2017-04-13T12:48:25.933Z
Luca Matteis
<p>One major drawback of (EC)DSA is that it requires a good RNG, otherwise <a href="https://bitcoin.stackexchange.com/a/12837/1137">the private key may be accidentally exposed</a>. This is also one of the major reasons (I found so far) why no(?) smartcard supports any kind of DSA. In contrast to that, RSA, while usually being used for encryption, can also be used for digital signatures and behaves deterministic, i.e. signing the same message again will yield the same signature everytime. Lacking the requirement of a RNG (other than in key <em>generation</em>) this is why RSA is available on many smartcards, which would make bitcoin much safer without requiring a rather complicated offline-wallet setup.</p>

<p>So, does ECDSA provide anything bitcoin absolutely needs that RSA cannot achieve? Or is it merely bad luck in Satoshi's choice?</p>

CC BY-SA 3.0
2014-12-22T18:54:30.547Z
This problem has been solved: generate `k` for signatures deterministically instead of by RNG. See [RFC 6979](http://tools.ietf.org/rfc/rfc6979.txt).
Chuck Batson
<signature><ecdsa>
What's the rationale of using ECDSA instead of RSA?
Tobias Kienzler
# What's the rationale of using ECDSA instead of RSA?

(Asked by: username_0 on 2014-01-28)

One major drawback of (EC)DSA is that it requires a good RNG, otherwise [the private key may be accidentally exposed](https://bitcoin.stackexchange.com/a/12837/1137). This is also one of the major reasons (I found so far) why no(?) smartcard supports any kind of DSA. In contrast to that, RSA, while usually being used for encryption, can also be used for digital signatures and behaves deterministic, i.e. signing the same message again will yield the same signature everytime. Lacking the requirement of a RNG (other than in key *generation*) this is why RSA is available on many smartcards, which would make bitcoin much safer without requiring a rather complicated offline-wallet setup.

So, does ECDSA provide anything bitcoin absolutely needs that RSA cannot achieve? Or is it merely bad luck in Satoshi's choice?

**Tags:** signature, ecdsa

> **Comments:**
> **username_1**: This problem has been solved: generate `k` for signatures deterministically instead of by RNG. See [RFC 6979](http://tools.ietf.org/rfc/rfc6979.txt).  

---

## 3 answers

### Answer by username_7 on 2014-01-28. Score: 13 | Accepted answer

I'm not sure why you think RSA is *much safer* than ECDSA. As you can read here: <https://crypto.stackexchange.com/questions/3216/signatures-rsa-compared-to-ecdsa>

ECDSA offers same levels of security as RSA, but with a much smaller footprint.

In fact, the more you increase the security, the larger the RSA keys become compared to ECDSA. This makes RSA less fit for a system such as bitcoin which requires small packets to be sent around the network all the time (being peer-to-peer).

> **Comments:**
> **username_0**: I didn't claim RSA was _safer_, merely that it apparently can be implemented more easily on smartcards. The smaller footprint is a severe reason though, due to the blockchain containing all signatures ever made  
> **username_7**: As far as I can tell you claim that RSA is safer, compared to ECSDA, because it doesn't require a good RNG. Not sure this claim is proven in the link you posted.  
> **username_0**: Oh, that was badly phrased, sorry - I merely wanted to use that as a transition on why there appear to exist no ECDSA smartcards  

---

### Answer by username_2 on 2017-12-07. Score: -1

Actually, RSA is broken. The Fasterfactor algorithm, is a high speed factorization for very large numbers:

[![enter image description here](https://i.sstatic.net/ZZ4Se.png)](https://i.sstatic.net/ZZ4Se.png)

> **Comments:**
> **username_3**: If RSA was broken, I think I'd have heard about it somewhere, probably on the front page of the New York Times or something.  
> **username_4**: Citation needed!  If this is your own proposed novel attack, then this is not the place to share it.  People will probably not take it seriously until you have released code, cracked well-known challenge messages, or published your attack in a peer-reviewed journal.  Your image doesn't seem to contain anything beyond simple algebra and I would bet a lot that the idea has already been considered and shown not to be significant.  

---

### Answer by username_5 on 2017-10-18. Score: -1

Now with vulnerability found in RSA it looks like a good choice… then in the past
<https://crocs.fi.muni.cz/public/papers/rsa_ccs17> .
With Amazon AWS (Intel E5-2650 v3@3GHz) you can crack 512bit RSA key proximately in 2 hours.

> **Comments:**
> **username_6**: This is not a vulnerability in RSA itself but rather in the way that a certain cryptographic library generates RSA keys. Keys not generated with this library are not vulnerable. Shorter keys (keys with length less than 2048 bits) are generally considered insecure anyways.  

---

