6 ms·
8192 bit RSA key is one or two notches above overkill. 2048 is expected to last many more decades, and I haven't seen 4096 outside tin-foil hat environments. I
by BoppreH 13y ago
8192 bit RSA key is one or two notches above overkill. 2048 is expected to last many more decades, and I haven't seen 4096 outside tin-foil hat environments. I know our national root certification authority uses 4096, for example.
I propose such a key actually decreases security because it is less compatible with existing software, training the users to further ignore warnings or dangerously tinker with their security settings.
Which one is more likely? NSA being able to break 4096 keys, but not 8192, or your user accepting an invalid certificate because "the key is probably just too big", or "it drains too much battery"? Which one will have more impact down the line?
Besides, if you are worried about such sophisticated attackers, your priority should be securing side channels and protecting yourself from rubber-hose cryptanalysis (http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis http://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis).
- handsomeransoms 13y agoIt's extravagant, and doesn't provide meaningful security. How much do you pay the armed guards that stand watch over your laptop 24/7? "Using encryption on the Internet is the equivalent of arranging an armored car to deliver credit card information from someone living in a cardboard box to someone living on a park bench." — Gene Spafford (Hat tip to schoen: http://www.loyalty.org/~schoen/rsa/ http://www.loyalty.org/~schoen/rsa/)
- quesera 13y agoSurely Spaf has recanted by now.
- declan 13y agoIf I read this recent (post-Snowden) blog post of spaf's correctly, he hasn't: https://www.cerias.purdue.edu/site/blog/post/just_sayin/ https://www.cerias.purdue.edu/site/blog/post/just_sayin/ Though he notes that his armored car quip is approaching 20 years old, dating back to the dark days of Windows 95. Perhaps the better way to think about it is: encryption is necessary but not sufficient. If the NSA has extruded its tentacles into sufficient endpoints (operating systems? firmware? antivirus software?) that's a problem that encryption won't by itself solve. Hey, I'm channeling RMS: free software is the real solution! Unless the NSA's tentacles extend to the compiler you use to compile the free software. :)
- michael_dorfman 13y agoOr, channeling Ken Thompson: Unless the tentacles extend to the compiler you use to compile the compiler you use to compile the free software. (Lather. Rinse. Repeat.)
- MichaelGG 13y agoSource for 2048 being good for "many more decades"? I thought it was getting close (10 years?) to the point where you might not want to use it, particularly without PFS setup, for anything requiring long-term use.
- BoppreH 13y agoThe http://www.keylength.com http://www.keylength.com website mentions various standards suggesting key lengths. For example, from ECRYPT II Recommendations (2012) there's a mention of 2432 bit giving reasonable protection up to the year 2030. There's also a nice answer on the crypto stack exchange: http://crypto.stackexchange.com/a/1982 http://crypto.stackexchange.com/a/1982 Reviewing the sources, I admit "many more decades" might be an overestimation, maybe "a couple decades" would be a more accurate statement. Still, the current factorization record is only 768 bit, and even the lowly 1024 bit key is orders of magnitude stronger than that.
- ppereira 13y agoWhat is the relative cost in cpu/memory of encrypting with 8192 bit vs. 2048 bit RSA?
- wyager 13y agoAccording to the article, it ranges from 16x more time-complex to 256x more time-complex, depending on what you're doing with it.
- bennyg 13y agoThis is a good analysis as well: http://security.stackexchange.com/questions/41937/pgp-rsa-key-size-encryption-decryption-time http://security.stackexchange.com/questions/41937/pgp-rsa-ke...
- runeks 13y agoNote that with HTTPS, the actual data is not encrypted with the RSA keys. They are only used to negotiate a shared symmetric key, with which everything is encrypted. So it's only the initial handshake that takes longer.
- joosters 13y agoIt's also pointless because there are top-level CAs that use smaller keys. Hence if your key is bigger, hackers would go after the smaller and easier-to-factorise keys, gaining you nothing.
- ctz 13y agoIndeed, there are still 21 CA certs in debian ca-certificates with 1024-bit keys. Deploying anything stronger for endpoint keys is a tremendous waste of computation.
- lmm 13y agoOnly if your certificate is going to expire before those 21 do.
- ctz 13y agoGood point. Here are the expiration dates for the 21 certs: Not After : Jan 14 16:29:17 2007 GMT Not After : Aug 13 23:59:00 2018 GMT Not After : Aug 22 16:41:51 2018 GMT Not After : Dec 9 19:47:26 2018 GMT Not After : Dec 10 18:40:23 2018 GMT Not After : Feb 20 14:08:11 2019 GMT Not After : Feb 20 14:10:22 2019 GMT Not After : May 25 16:39:40 2019 GMT Not After : Jun 23 12:14:45 2019 GMT Not After : Jun 25 22:23:48 2019 GMT Not After : Jun 26 00:19:54 2019 GMT Not After : Jun 26 00:22:33 2019 GMT Not After : Jun 21 04:00:00 2020 GMT Not After : Jun 21 04:00:00 2020 GMT Not After : Dec 31 23:59:59 2020 GMT Not After : Dec 31 23:59:59 2020 GMT Not After : Aug 1 23:59:59 2028 GMT Not After : Aug 1 23:59:59 2028 GMT Not After : Aug 1 23:59:59 2028 GMT Not After : Aug 2 23:59:59 2028 GMT Not After : Aug 2 23:59:59 2028 GMT It's somewhat surprising that one of the certificates has already expired, but is still in ca-certificates.
- slashdotaccount 13y agoThis is false. 2048 bit is expected to last only 6 more years by cautious projections, and only until 2030 by conservative projections: Method Date Symmetric Asymmetric Discrete Key Logarithm Group Elliptic Curve Hash Lenstra/Verheul 2023 88 2054 1632 155 2054 166 175 Lenstra Updated 2030 88 1698 2063 176 1698 176 176 ECRYPT II 2016-2020 96 1776 192 1776 192 192 NIST 2011-2030 112 2048 224 2048 224 224 ANSSI 2010-2020 100 2048 200 2048 200 200 RFC3766 - 103 2056 206 2056 192 - BSI (sig. only) > 2020 - 1976 256 2048 250 256 Source: http://www.keylength.com/ http://www.keylength.com/ I agree that 8192 is overkill. GNUtls 3.0.28: certtool -p --sec-param=high comes out to 3248 bits.