Berenstein factoring breakthrough?

[Ben Goren <ben_(_at_)_trumpetpower_(_dot_)_com>]

I know  Dan isn't  exactly everybody's  favorite person,  but he's
recently  published  a  paper  that   describes  how  to  make  an
inexpensive special-purpose machine to crack  RSA keys less than 2
kbits long:

    http://cr.yp.to/papers/nfscircuit.ps

I won't pretend to be able to understand all--or even most--of the
paper, but I would hope that there are people here who can.

So: would anybody  care to confirm or refute  his findings? If so,
what effects  does this have  on the various  subsystems (OpenSSL,
OpenSSH, etc.) that implement RSA? Do we need new defaults for key
length, or do we need a new algorithm, or...?

b&

--
Ben Goren
 mailto:ben_(_at_)_trumpetpower_(_dot_)_com
 http://www.trumpetpower.com/
 icbm:33o25'37"N_111o57'32"W

[demime 0.98d removed an attachment of type application/pgp-signature]