6 ms·

Unless you're worried about storing and/or transmitting a huge amount of keys (in the order of "at least 100/second") and/or using one key "at least 100 times/s

Unless you're worried about storing and/or transmitting a huge amount of keys (in the order of "at least 100/second") and/or using one key "at least 100 times/second", why not just go for 4096 by default?

upofadown 3y ago
If you accept the current assumptions, then you would have to accept that 4096 bit RSA will be obsolete by 2060.
- thewataccount 3y ago
  That's a significant amount of time if we're talking about long-term file storage. I've had my dropbox account for over 10 years now. Being concerned about a timescale of 20 to 30 years seems reasonable for things like long term file storage IMO. Backblaze, dropbox, google drive, onedrive, AWS are all over a decade old.
  - ignoramous 3y ago
    > That's a significant amount of time Depends on the threat model. I mean, WireGuard and Signal rotate derived keys every 2mins!
  - denton-scratch 3y ago
    > I've had my dropbox account for over 10 years now. Being concerned about a timescale of 20 to 30 years seems reasonable for things like long term file storage IMO. But you're relying on your chosen cloud-provider staying around for 30 years. The number of tech companies that have died in the last 30 years easily exceeds the number still standing [citation needed].
    - thewataccount 3y ago
      > But you're relying on your chosen cloud-provider staying around for 30 years. Yes, and I recognize that the company existing, or at least that product existing for that long isn't incredibly likely. But I think the fact that there's 3 products from massive companies like Amazon, Google, Microsoft, and 2 from smaller ones, dropbox/backblaze that lasted 10 years means that at the very minimum ~20 years should be considered as realistically possible. And honestly, if we're willing to assume whatever we're storing isn't worth them storing for longer (let's say against your will) - then you should just rekey it anyway yourself. But I'm lazy, and again we're getting to near 15 years for some of those services now. > The number of tech companies that have died in the last 30 years easily exceeds the number still standing [citation needed]. I don't disagree with your premise that the company/product you pick isn't likely to last for 30 years - however I don't think this specific statistic is the correct one to evaluate this with, given the wide range of tech companies with differing products, markets, financial situations, regulations, the many startups that are effectively designed to be acquired, etc. At the very least, I don't think it's fair to compare Google/Microsoft/AWS to "insert latest crypto based file storage startup" in terms of long-term viability.
      - denton-scratch 3y ago
        OK, so you're up for a bet. Thats fine by me - once a year I bet on the gee-gees in The Grand National.
- yjftsjthsd-h 3y ago
  So only 37 years? I think I can live with that.
  - bee_rider 3y ago
    It depends on what you are transmitting, right? Hypothetically if you are a journalist working with communications from a source in an authoritarian country (or a country that could become authoritarian in the next 4 decades; and name one that couldn’t, right?) it would be no good if you got some elderly person killed in the future. Or just like bank account details I guess?
    - supertrope 3y ago
      If extreme security is needed it’s time to turn off your computer, leave your cellphone at home, don’t tell details to colleagues who do not have a need to know, and maybe resort to dead drop methods so even you don’t know who the source is yourself.
      - bee_rider 3y ago
        Some people are willing to take a on some extra risk to talk to journalists, and the world is a better place for their bravery. And we’re talking about thousands of bits, we spend way more than that on stupid things like making UI slightly prettier. I’m streaming music at, I guess, ~200kbps, why not spend a couple seconds worth of music on keys? (Who knows, maybe it will protect some famous journalist somehow and we’ll end up ahead when it spares us a whole moment of silence). Edit: TBH I’m not really sure this is a useful way to look at things, but the music bandwidth/moment of silence parallel was too convenient to pass up.
    - trilobyte 3y ago
      In that case the volume of traffic such a communication medium would need to handle is likely small enough that you can bump the key size higher to ensure greater longevity, currently past the lifetimes of those involved, and accept that transmitting data will take a small fraction of time longer.
- devmor 3y ago
  I would hope that someone invents a more robust cryptography protocol in the next 37 years.
  - wongarsu 3y ago
    A bit less, since you have to worry about an attacker storing anything you do now for future attacks. But if you only want any given secret to stay save for 20 years, you can still use 4096 bit RSA for another 17 years. Which sounds like a good tradeoff: enough of time for better algorithms to get established, but little risk of a breach you will care about.
  - capableweb 3y ago
    Isn't RSA from like the 80s? That would already make it ~40 years old.
    - woodruffw 3y ago
      Being pedantic: RSA is a cryptosystem, not a protocol, and the parameters that were used in 1980s RSA encryption look nothing like the parameters used in today's RSA (in part because they're much larger now, but also in part because we now know about all the weird things that happen when you choose non-standard exponents, primes that are too close to each other, etc.). RSA is also not typically described as robust, for those reasons.
H8crilA 3y ago
Because that will soon become "why not 128k". Or perhaps we should use 2 megabytes for each prime? We don't know, but it's better to be safe than sorry.
loeg 3y ago
Because 4096 bit RSA is a lot slower and bigger and those things matter. And there isn't any upside? If you're actually worried about 2048-bit RSA (and you should not be), you should switch to one of the elliptic curve schemes.
- adgjlsfhk1 3y ago
  I'm not actually sure about this. the elliptic curve schemes are just as broken with quantum computers, and the larger key size of rsa seems like it might add a few years of overhead in terms of qbits needed. not an expert though
- Grimburger 3y ago
  All other things equal, 256-bit elliptical curve cryptography is going to break before RSA2048 does with quantum computing advances. Do NOT switch to ECC if your threat model includes a quantum computer arriving. Either use larger RSA keys or more appropriately a hybrid signature scheme combining one of NIST's PQC signatures and a traditional algorithm. https://csrc.nist.gov/Projects/post-quantum-cryptography/selected-algorithms-2022 https://csrc.nist.gov/Projects/post-quantum-cryptography/sel...

upofadown 3y ago

If you accept the current assumptions, then you would have to accept that 4096 bit RSA will be obsolete by 2060.

thewataccount 3y ago
That's a significant amount of time if we're talking about long-term file storage. I've had my dropbox account for over 10 years now. Being concerned about a timescale of 20 to 30 years seems reasonable for things like long term file storage IMO. Backblaze, dropbox, google drive, onedrive, AWS are all over a decade old.
- ignoramous 3y ago
  > That's a significant amount of time Depends on the threat model. I mean, WireGuard and Signal rotate derived keys every 2mins!
- denton-scratch 3y ago
  > I've had my dropbox account for over 10 years now. Being concerned about a timescale of 20 to 30 years seems reasonable for things like long term file storage IMO. But you're relying on your chosen cloud-provider staying around for 30 years. The number of tech companies that have died in the last 30 years easily exceeds the number still standing [citation needed].
  - thewataccount 3y ago
    > But you're relying on your chosen cloud-provider staying around for 30 years. Yes, and I recognize that the company existing, or at least that product existing for that long isn't incredibly likely. But I think the fact that there's 3 products from massive companies like Amazon, Google, Microsoft, and 2 from smaller ones, dropbox/backblaze that lasted 10 years means that at the very minimum ~20 years should be considered as realistically possible. And honestly, if we're willing to assume whatever we're storing isn't worth them storing for longer (let's say against your will) - then you should just rekey it anyway yourself. But I'm lazy, and again we're getting to near 15 years for some of those services now. > The number of tech companies that have died in the last 30 years easily exceeds the number still standing [citation needed]. I don't disagree with your premise that the company/product you pick isn't likely to last for 30 years - however I don't think this specific statistic is the correct one to evaluate this with, given the wide range of tech companies with differing products, markets, financial situations, regulations, the many startups that are effectively designed to be acquired, etc. At the very least, I don't think it's fair to compare Google/Microsoft/AWS to "insert latest crypto based file storage startup" in terms of long-term viability.
    - denton-scratch 3y ago
      OK, so you're up for a bet. Thats fine by me - once a year I bet on the gee-gees in The Grand National.
yjftsjthsd-h 3y ago
So only 37 years? I think I can live with that.
- bee_rider 3y ago
  It depends on what you are transmitting, right? Hypothetically if you are a journalist working with communications from a source in an authoritarian country (or a country that could become authoritarian in the next 4 decades; and name one that couldn’t, right?) it would be no good if you got some elderly person killed in the future. Or just like bank account details I guess?
  - supertrope 3y ago
    If extreme security is needed it’s time to turn off your computer, leave your cellphone at home, don’t tell details to colleagues who do not have a need to know, and maybe resort to dead drop methods so even you don’t know who the source is yourself.
    - bee_rider 3y ago
      Some people are willing to take a on some extra risk to talk to journalists, and the world is a better place for their bravery. And we’re talking about thousands of bits, we spend way more than that on stupid things like making UI slightly prettier. I’m streaming music at, I guess, ~200kbps, why not spend a couple seconds worth of music on keys? (Who knows, maybe it will protect some famous journalist somehow and we’ll end up ahead when it spares us a whole moment of silence). Edit: TBH I’m not really sure this is a useful way to look at things, but the music bandwidth/moment of silence parallel was too convenient to pass up.
  - trilobyte 3y ago
    In that case the volume of traffic such a communication medium would need to handle is likely small enough that you can bump the key size higher to ensure greater longevity, currently past the lifetimes of those involved, and accept that transmitting data will take a small fraction of time longer.
devmor 3y ago
I would hope that someone invents a more robust cryptography protocol in the next 37 years.
- wongarsu 3y ago
  A bit less, since you have to worry about an attacker storing anything you do now for future attacks. But if you only want any given secret to stay save for 20 years, you can still use 4096 bit RSA for another 17 years. Which sounds like a good tradeoff: enough of time for better algorithms to get established, but little risk of a breach you will care about.
- capableweb 3y ago
  Isn't RSA from like the 80s? That would already make it ~40 years old.
  - woodruffw 3y ago
    Being pedantic: RSA is a cryptosystem, not a protocol, and the parameters that were used in 1980s RSA encryption look nothing like the parameters used in today's RSA (in part because they're much larger now, but also in part because we now know about all the weird things that happen when you choose non-standard exponents, primes that are too close to each other, etc.). RSA is also not typically described as robust, for those reasons.

H8crilA 3y ago

Because that will soon become "why not 128k". Or perhaps we should use 2 megabytes for each prime? We don't know, but it's better to be safe than sorry.

loeg 3y ago

Because 4096 bit RSA is a lot slower and bigger and those things matter. And there isn't any upside? If you're actually worried about 2048-bit RSA (and you should not be), you should switch to one of the elliptic curve schemes.

adgjlsfhk1 3y ago
I'm not actually sure about this. the elliptic curve schemes are just as broken with quantum computers, and the larger key size of rsa seems like it might add a few years of overhead in terms of qbits needed. not an expert though
Grimburger 3y ago
All other things equal, 256-bit elliptical curve cryptography is going to break before RSA2048 does with quantum computing advances. Do NOT switch to ECC if your threat model includes a quantum computer arriving. Either use larger RSA keys or more appropriately a hybrid signature scheme combining one of NIST's PQC signatures and a traditional algorithm. https://csrc.nist.gov/Projects/post-quantum-cryptography/selected-algorithms-2022 https://csrc.nist.gov/Projects/post-quantum-cryptography/sel...