What is the reasoning behind keeping hidden service onion RSA keys at 1024 length?

Question

• Is the cost to performance of using larger key length not cost effective?
• How would it negatively impact anyone if some hosts decided to use a larger key length (i.e. Why isn't anyone free to manually use a larger key length if they so choose for their hidden service)?
• In terms of brute force resistance how does the current 1024 length RSA keys stand up against AES 128 used by several HTTPS sites.
• Is perfect forward secrecy built into the encryption used with hidden services? If not, are there plans to include it in future Tor versions?
• Are there plans to eventually increase mandatory and/or default onion RSA key length beyond 1024? And if not, when might we see this topic become reviewed (for example, is the current strength and implementation of the protocol considered good enough that we should expect no further work done on it in several years time?)?

Answer 1

There is a proposal to add Ed25519 keys in version 0.2.5

Answer 2

RSA asymmetric encryption works really slowly, and the bigger the n and the message is, the harder the computer is going to have to work, thats why PGP exists.

Note that RSA encryption works by:
message pow e mod n

PGP encrypts the symmetric encryption key for the message in RSA/DSA/ElGamel and then encrypt the message with IDEA, and make encryption/decryption significantly faster.

AES192 is sufficient for most things in the world, in fact, when AES256 was in operation, cryptographers described it an overkill.

Don't expect RSA1024 to be cracked in the near future, because when RSA 768 was, 2000 2.2Ghz Opertron CPUs and 3 years time was used.