2 ms·

There must be something I'm missing here. As far as I know, the state of the art is to use 256 bits for encryption keys, both for symmetric (AES-256, Chacha20)

by cesarb 5y ago

There must be something I'm missing here. As far as I know, the state of the art is to use 256 bits for encryption keys, both for symmetric (AES-256, Chacha20) and asymmetric (Curve25519, the 256-bit NIST curves), and they are considered both fast and safe. Are they trying to ban some kind of post-quantum cryptography which uses larger keys?

bretpiatt 5y ago
For TLS much larger keys are typically used, "The recommended minimum key length is 1024 bits, with 2048 bits preferred, but this is up to a thousand times more computationally intensive than symmetric keys of equivalent strength (e.g. a 2048-bit asymmetric key is approximately equivalent to a 112-bit symmetric key) and makes asymmetric encryption too slow for many purposes." Source: https://www.internetsociety.org/deploy360/tls/basics/ https://www.internetsociety.org/deploy360/tls/basics/
- resoluteteeth 5y ago
  This is wrong at least as a response to the original comment, which is correct about the state of the art (TLS is also moving to elliptic curves where shorter keys are used).
  - _wldu 5y ago
    For signatures, I hope EdDSA wins out over ECDSA.
- monocasa 5y ago
  TLS isn't encrypting data with those longer keys. That's used for auth and connection bring up before switching to a symmetric encryption scheme to actually encrypt data.
Retr0id 5y ago
Curve448 also exists, which uses ~448-bit keys. Although with that, it only offers 224 bits of security (Compared to Curve25519's 128). And NIST-P521 exists, with similar properties. I wonder whether this legislation strictly applies to the bits-of-security, or bits-of-key-length. IIUC, AES-256 will be fine for the forseeable future, even with quantum computers. However, Curve25519 could fall relatively soon, depending on how rapidly quantum computing advances.

2 ms·

There must be something I'm missing here. As far as I know, the state of the art is to use 256 bits for encryption keys, both for symmetric (AES-256, Chacha20)

by cesarb 5y ago

bretpiatt 5y ago
For TLS much larger keys are typically used, "The recommended minimum key length is 1024 bits, with 2048 bits preferred, but this is up to a thousand times more computationally intensive than symmetric keys of equivalent strength (e.g. a 2048-bit asymmetric key is approximately equivalent to a 112-bit symmetric key) and makes asymmetric encryption too slow for many purposes." Source: https://www.internetsociety.org/deploy360/tls/basics/ https://www.internetsociety.org/deploy360/tls/basics/
- resoluteteeth 5y ago
  This is wrong at least as a response to the original comment, which is correct about the state of the art (TLS is also moving to elliptic curves where shorter keys are used).
  - _wldu 5y ago
    For signatures, I hope EdDSA wins out over ECDSA.
- monocasa 5y ago
  TLS isn't encrypting data with those longer keys. That's used for auth and connection bring up before switching to a symmetric encryption scheme to actually encrypt data.
Retr0id 5y ago
Curve448 also exists, which uses ~448-bit keys. Although with that, it only offers 224 bits of security (Compared to Curve25519's 128). And NIST-P521 exists, with similar properties. I wonder whether this legislation strictly applies to the bits-of-security, or bits-of-key-length. IIUC, AES-256 will be fine for the forseeable future, even with quantum computers. However, Curve25519 could fall relatively soon, depending on how rapidly quantum computing advances.