7 ms·

Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time m

• Suzuran 2y ago
  Because the only way to force their use is to break things, mostly this means transferring the pain directly to the user instead of the service operators in the hope that they will bitch loudly enough for the service operator to care, and this has a good chance of instead causing the user to move to your competitors instead, who will be more than willing to not let a little thing like security get between them and revenue.
• bananapub 2y ago
  > why we're not dramatically ramping up key sizes across the board on all encryption? because no one thinks there is a reason to, no one has any fear that classical computers will catch up with RSA-2048/AES-128 before their grand children are dead. post-quantum crypt stuff is happening and people are planning how to migrate to it.
  • EVa5I7bHFq9mnYK 2y ago
    Well, even MD4 hasn't been cracked yet.
    • kbolino 2y ago
      What is your definition of cracked? Collisions are easy to produce; there's one right on the Wikipedia page.
      • EVa5I7bHFq9mnYK 2y ago
        Collisions are not interesting. Millions of leaked passwords hashed with MD4/MD5 are of very practical interest.
        • deleted 2y ago
          [deleted]
        • kbolino 2y ago
          Ok, preimage resistance is still pretty strong, but it has been reduced enough that I wouldn't trust it remaining above practical attacks beyond the next decade.
        • lo0dot0 2y ago
          If you use the same password on different sites despite password managers and now passkeys you are asking for it.
• deleted 2y ago
  [deleted]
• croes 2y ago
  > Even simple things like forcing TLS 1.3 instead of 1.2 from client side breaks things...including hn site. That’s the reason, it breaks things, and some of them are important and can’t simply be updated.
  • deleted 2y ago
    [deleted]
  • wolrah 2y ago
    > That’s the reason, it breaks things, and some of them are important and can’t simply be updated. IMO this is not a valid excuse. If it's exposed to the internet it needs to be able to be updated with relative ease to respond to a changing threat landscape. Especially if it's "important". If it cannot be then it is already broken and needs to be fixed. Whether that fix is doing a hard upgrade to get to the point that future upgrades can be easier, entirely replacing the component, or taking the thing offline to a private non-Internet network depends on the situation, but "we aren't going to change, the rest of the internet should conform to us" has never been a reasonable response. This is particularly true in the contexts of public mail servers where DKIM matters and anything involving public use of TLS. The rest of the internet should not care if your company refuses to update their mail servers or replace their garbage TLS interception middleboxes. We should be happy to cause problems for such organizations.
    • bawolff 2y ago
      > IMO this is not a valid excuse. The world is full of things that aren't "valid excuses". Explaining why something is the way it is is not the same as justifying it.
• daneel_w 2y ago
  Probably because RSA 2048 is not yet broken, and once there we still have RSA 4096 to lean back on which is since quite some time the most common key size for most things using RSA (DKIM being one of the exceptions). In the context of DKIM we're waiting for Ed25519 to reach major adoption, which will solve a lot of annoyances for everyone.
  • throw0101c 2y ago
    > Probably because RSA 2048 is not yet broken […] 3072 has been recommended by various parties for a few years now: * https://www.keylength.com https://www.keylength.com
    • bluGill 2y ago
      RSA 2048 isn't broken, but experts consider it a matter of time. How long I don't know, but since the attacks are known (prime numbers) someone (read not me) can make an estimate with error bars that are concerning enough to consider it as good as broken.
      • tptacek 2y ago
        What expert considers it a matter of time before 2048 is broken? 2048 is 112-bit-equivalent security.
        • coppsilgold 2y ago
          RSA2048 is 112-bit-equivalent symmetric security under currently known methods. Number theory advances may change that. It is hard to imagine any significant advances in the breaking of symmetric cryptography (mathematically-unstructured permutations). Cryptographically-relevant quantum computers (CRQC's) will also break smaller RSA keys long before (years?) the bigger ones. CRQC's can theoretically halve symmetric cryptography keys for brute force complexity (256-bit key becomes 128-bit for a CRQC cracker).
        • bluGill 2y ago
• xondono 2y ago
  We are doing that, just not everyone is as concerned by safety and make different tradeoffs against things like ease of use or accessibility. Different applications have different tolerances and that’s fine. If and when anything quantum is able to yield results (I wouldn’t worry much about this), increasing key size is pretty much meaningless, you need to move to other encryption schemes (there’s lots of options already).
  • daneel_w 2y ago
    In the case of RSA it's not meaningless to increase key size to fend off quantum computers. Quantum computing vs RSA is a case of being the largest contender, because quantum computing in itself doesn't definitively unravel the integer factorization problem.
    • xondono 2y ago
      I meant “meaningless” in the sense that your encryption is then on heavy diminishing returns territory when it comes to defending against a qc. It will likely work for a while, but it’s a fundamentally wrong approach and you’re going to be exposed into recording & decryption attacks, instead of breaking your encryption today, I just store all your communications and wait for the next qc to be online, then fish for stuff that is still useful. It’s a silly approach if the timeframe is 50 years because most secret information goes stale quicker, but if you’re just waiting for say a year…
    • bawolff 2y ago
      That seems suspect to me. Getting a working qc to reasonable scale is the hard part. Once you have done that most of the hard engineering problems are solved. I doubt doubling its size at that point would be very much of a problem. If we are making (uninformed) predictions, i bet we wont see QC solving 1024 bit RSA in the next 15 years (at least), but once it does it will only take a year or two more to solve 4096.
• elif 2y ago
  512 DKIM was exceedingly rare even 8 years ago when I worked in email. You're essentially asking "why aren't we doing what we're doing"
• littlestymaar 2y ago
  > Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time measure. We've been doing it for decades now… (DES used 56bits back then, AES started at 128). Also, keep in mind that increasing the key length by 1 means that you need twice as much compute to crack it through brute force (that is, unless cryptanalysis shows an attack that reduces the difficulty of the scheme, like for instance with the number field sieve on RSA) so you don't need to increase key size too often: following Moore's law, you need to increase it by on bit every two years, or 5 bits every decades. Additionally key size generally account for many years of compute progress and theoretical advance, so that you really don't need to worry about that over a short period (for the record higest RSA factorization to date is 829 bits, yet people started recommending migration away from 1024 bit RSA a decade ago or so, and the industry is in the process in deprecating it entirely even though it's probably going to take years before an attack on it becomes realistic.
• formerly_proven 2y ago
  Compare the time it takes to generate or decrypt/encrypt 4096 bit RSA versus 16384 bit RSA (it's not four times slower).
  • Havoc 2y ago
    Indeed. There has got to be some middle ground there though that is both an incremental improvement and still within reason on cost
• paulnpace 2y ago
  In the case of DKIM, Ed25519.
• marcosdumay 2y ago
  The key sizes we use today are expected to hold against a Dyson sphere focused on breaking them with the best exploit we know today. What size do you suggest?
  • RobotToaster 2y ago
    It's not quantum-safe though.
    • Avamander 2y ago
      It's not quantum-broken though, it might just make it a bit faster. Just half a Dyson sphere.
    • marcosdumay 2y ago
      Larger keys won't make the algorithms quantum-safe either.
      • Tostino 2y ago
        If I'm not mistaken, larger keys require more qbits in a machine to all be coherent together to be able to break it. So it would be a slight increase in complexity, but if we are able to build a machine with enough qbits to crack 1024 keys, I don't think the engineering is all that far off from slightly scaling things up 2x-10x.
      • dist-epoch 2y ago
        Which is why post-quantum algos were invented.
        • TacticalCoder 2y ago
          > Which is why post-quantum algos were invented. Yup. And I don't even think quantum resistance was the goal of some of the algos that, yet, happen to be believed to be quantum resistant. Take "Lamport signatures" for example: that's from the late seventies. Did anyone even talk about quantum computers back then? I just checked and the word "quantum" doesn't even appear in Lamport's paper.
• tptacek 2y ago
  We are. 1024-bit keys are being retired across cryptosystems everywhere, and have been for over a decade (don't get me started on the one laggard). Nothing threatens 2048 bit keys other than QC, which threatens RSA altogether. Progress isn't linear; it's not like 2048 falls mechanically some time after 1024 (which itself is not practical to attack today).
  • 1oooqooq 2y ago
    we are definitely not. most countries registrar's won't support DNS hacks requied for larger dkim. we still use the minimum key size in most countries.
    • Avamander 2y ago
      What? Just use normal name servers. The registrar doesn't matter one bit, they delegate the zone to whatever name servers you specify. Those can serve whatever records properly.
      • deleted 2y ago
        [deleted]
  • sedatk 2y ago
    People might be assuming that 2048-bits is only twice as strong as 1024-bits, but it's in fact a billion times better. (corrected, thanks!)
    • AlotOfReading 2y ago
      That would be true if RSA scaled proportionally with the number of bits, but the exponent involved is much lower than 1. 1024->2048 gives you around the same difficulty as adding 30 bits to a symmetric key.
      • duskwuff 2y ago
        It's also only true so long as we don't discover more efficient ways of factoring large numbers. We haven't come up with any dramatic improvements lately, but it's always possible that something will come up. Symmetric crypto systems like AES are on much firmer ground, as they don't depend as heavily on the difficulty of any single mathematical problem.
• 1oooqooq 2y ago
  because everyone recommending those things work on both sides. they recommend 2048 and use 4096 themselves because if they need to ever break your 2048 it's less bad than if you were recommended to use 4069. wink wink same with everyone recommending ed22519 when ed448 is as good and as fast to encode. but all the arguments point to encode speed from a Bernstein paper which used a pentium iii! https://cr.yp.to/ecdh/curve25519-20060209.pdf https://cr.yp.to/ecdh/curve25519-20060209.pdf
• inetknght 2y ago
  > Could someone help me understand why we're not dramatically ramping up key sizes across the board on all encryption? Not as a solution, but as a buy-some-time measure. I am acutely aware that there are SOME places where software only supports RSA and only supports up to 1024-bit or 2048-bit keys, and that is a legal requirement. Ramping up key sizes would be great but even 2048-bit keys aren't quite secure against certain kinds of actors (even disregarding hammer-to-head style of attacks) > Even simple things like forcing TLS 1.3 instead of 1.2 from client side breaks things ... kind've a case in point about the pace of required improvements.
• tonymet 2y ago
  Key rotation tooling has never been given adequate attention since you only do it every few years. Something ends up breaking, even if it’s just the name of the key . keys are stateful content like DB schemas, but they don’t receive daily attention, so the tooling to maintain them is usually ad-hoc scripts and manual steps.
• layer8 2y ago
  Linear bit size increases require exponential compute increases to break. RSA with 1024 bits is still beyond any practical capability to break. The current practical limit is considered to be around 800-something bits. Still the recommendation is to use at least 3000 bits nowadays, to defend against possible mathematical advances.
  • Retr0id 2y ago
    This is incorrect. Factoring algorithms like GNFS are super-polynomial but sub-exponential. RSA-1024 is likely breakable at practical-but-very-expensive costs.
• hannob 2y ago
  "dramatically ramping up key sizes" is not done, because it's overly expensive, and not needed. What people don't realize: key size recommendations are surprisingly stable over long timeframes, and have not changed for a very long time. In the early 2000s, some cryptographers started warning that 1024 bit RSA is no longer secure enough, and in the following years, recommendations have been updated to 2048 bit minimum. That's now been a stable recommendation for over 20 years, and there's not the slightest sign that 2048 bit can be broken any time soon. The only real danger for RSA-2048 is quantum computers. But with quantum computers, increasing your RSA key sizes does not buy you much, you have to move to entirely different algorithms.
  • Avamander 2y ago
    > That's now been a stable recommendation for over 20 years, and there's not the slightest sign that 2048 bit can be broken any time soon. Except that now the recommendation by NIST at least is to switch to 2048-bit by 2030 and then deprecate RSA altogether by 2035. But yeah, not being on at least 1024-bit RSA is weird and careless.
• JackSlateur 2y ago
  Old but still relevant: https://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html https://www.schneier.com/blog/archives/2009/09/the_doghouse_... These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space. Long story short, brute forcing AES256 or RSA4096 is physically impossible
  • nmadden 2y ago
    That’s true for AES-256. But brute force attacks are not the most efficient way to attack RSA, so it’s not true in that case. (Eg quantum computers would break RSA-4096 but not AES-256).
    • ironhaven 2y ago
      Grover’s algorithm could be described as quantum brute force that is able to break AES-128 but not AES-256
      • nmadden 2y ago
        Yes (although practically speaking it’s very unlikely that Grover will ever break AES-128), but that’s still a brute force attack and still subject to the physical limits mentioned in the Schneier quote. Whereas attacks on RSA like the number field sieve or Shor’s algorithm are much more efficient than brute force. (Which is why you need such big keys for RSA in the first place).