Asymmetric Cryptography: RSA Mathematics, Elliptic Curves (ECC) & DHE

Q: Why is RSA-1024 considered insecure today?

Due to advances in distributed computing and algorithms like the General Number Field Sieve (GNFS), factoring a 1024-bit modulus is now within reach of nation-state intelligence agencies. NIST retired RSA-1024 in 2013; the minimum requirement is RSA-2048.

Q: Why is Curve25519 preferred over NIST P-256 by many cryptographers?

Curve25519, designed by Daniel J. Bernstein, is completely immune to timing attacks, resists side-channel leakage, has no unexplained seed constants (avoiding NSA backdoor concerns), and is significantly faster than NIST curves.

In 1976, Whitfield Diffie and Martin Hellman published their groundbreaking paper "New Directions in Cryptography", introducing the concept of Public Key Cryptography. For thousands of years prior, communication required sender and receiver to share a secret key in person before exchanging messages. Asymmetric cryptography solved this limitation using mathematical "one-way trapdoor functions"—problems that are easy to compute in one direction, but computationally impossible to reverse without a private trapdoor key.

The RSA Algorithm: Prime Factorization Math

Introduced in 1977 by Ron Rivest, Adi Shamir, and Leonard Adleman, the RSA algorithm derives its mathematical security from the extreme computational difficulty of factoring the product of two massive prime numbers:

Step-by-Step RSA Key Generation Algorithm (Exam Standard)

Select two distinct large prime numbers, p and q (e.g. 1024 bits each).
Calculate the modulus: n = p * q. The bit length of n is the key length (e.g. 2048 bits).
Calculate Euler's Totient function: φ(n) = (p - 1) * (q - 1).
Choose a public exponent e such that 1 < e < φ(n) and gcd(e, φ(n)) = 1 (Standard industry default is e = 65537).
Compute the private exponent d using Modular Multiplicative Inverse: d * e ≡ 1 (mod φ(n)).
Public Key: (e, n) • Private Key: (d, n).
Encryption: Ciphertext = (Plaintext)^e mod n • Decryption: Plaintext = (Ciphertext)^d mod n.

Elliptic Curve Cryptography (ECC): Smaller, Faster & Stronger

While RSA remains widespread, modern cybersecurity is rapidly migrating to Elliptic Curve Cryptography (ECC). ECC operates over algebraic structures of elliptic curves defined by the Weierstrass equation: y^2 = x^3 + ax + b over a finite field. Security relies on the Elliptic Curve Discrete Logarithm Problem (ECDLP):

Feature	RSA Algorithm	Elliptic Curve Cryptography (ECC)
Key Length for 128-bit Security	3,072 bits (Bulky certificates)	256 bits (Tiny, lightweight certificates)
Computation & Battery Impact	Heavy CPU cycles and memory usage.	Ultra-fast; consumes 90% less battery on mobile and IoT devices.
Top Standard Curves	RSA-2048, RSA-4096	Curve25519 (X25519/Ed25519), NIST P-256 (secp256r1)

Diffie-Hellman Key Exchange (ECDHE) & Perfect Forward Secrecy

How can two servers create a shared symmetric key across an open Wi-Fi network without eavesdroppers discovering it? The Diffie-Hellman Key Exchange allows two parties (Alice and Bob) to combine their private keys with each other's public keys, independently arriving at the exact same shared secret!

What is Perfect Forward Secrecy (PFS)?

In legacy RSA handshakes, if an attacker recorded encrypted internet traffic for 5 years and eventually stole the server's static private key, they could decrypt all 5 years of historical traffic! Ephemeral Diffie-Hellman (ECDHE) generates a brand new, throwaway key pair for every single session. Even if the server's private certificate is compromised tomorrow, past recorded conversations remain completely unreadable!

Frequently Asked Questions (FAQ) - Student & Interview Review

Q1. Why is RSA-1024 considered insecure today?

Due to advances in distributed computing and algorithms like the General Number Field Sieve (GNFS), factoring a 1024-bit modulus is now within reach of nation-state intelligence agencies. NIST retired RSA-1024 in 2013; the minimum requirement is RSA-2048.

Q2. Why is Curve25519 preferred over NIST P-256 by many cryptographers?

Curve25519, designed by Daniel J. Bernstein, is completely immune to timing attacks, resists side-channel leakage, has no unexplained seed constants (avoiding NSA backdoor concerns), and is significantly faster than NIST curves.

Explore Related Cybersecurity Tutorials & Next Steps

Broaden your defensive and offensive security knowledge across our curriculum:

PKI, Digital Signatures & X.509

How RSA and ECC key pairs generate tamper-proof digital signatures.

Symmetric Encryption (AES-GCM)

Why asymmetric keys are used strictly for session negotiation, not bulk data.

TLS 1.3 Handshake Protocol

ECDHE key exchange via Curve25519 for perfect forward secrecy.

120+ Cybersecurity Interview Q&A

Technical interview questions on RSA key generation, padding, and ECC security.