

I hate to follow up to my own posting, but I should perhaps clarify
some things so I won't get flamed.

First of all, when I'm talking about ``factoring the modulus'' or a
``breakthrough in factoring'', what I really mean is a breakthrough in
the cryptanalysis of RSA.  I know that factoring and breaking RSA are
not proven to be equivalent; it's just so damn convenient not to
repeat this every time.

I also have to admit that I don't really know if the ``non-group''
property of a cipher is essential only for key chaining.  I have
thought about it a little while, but I can't find a way that a
cryptanalyst could exploit a group structure.  That, of course, means
nothing at all.

Then I wrote,


What I meant was that as long as the only advantage of the
cryptanalyst is a faster computer, then we will probably have RSA for
a long time to come, because even if 1024-bit moduli somehow could be
broken with fast computers (not with a new algorithm), then people
would simply use longer moduli.  Both users and cryptanalysts benefit
from better technology in the same way.

Hope this keeps the flames away...  Have fun.
