4 ms·

You don't know what you are saying. I suppose you speak about RSA-4096, which is about prime numbers. The 256 bits are just used as a seed to find large prime n

by Ihmahr 13y ago

You don't know what you are saying. I suppose you speak about RSA-4096, which is about prime numbers. The 256 bits are just used as a seed to find large prime numbers. The 256bit entropy is more than enough to be secure, and 4096 bit prime numbers are never as secure as 256 bit entropy.

bodyfour 13y ago
Even 64 bits would be sufficient as long as the entropy is good. It just needs to be large enough that bruteforcing 2^N isn't feasible. 256 seems like a perfectly safe amount to me.
- ryan-c 13y ago
  64 bits isn't enough to provide brute force protection, you need at least 80 bits, preferably 128 bits, and 256 bits if you're paranoid.
  - bodyfour 13y ago
    Yeah I should have elaborated a little more. I was in a rush. I wasn't trying to endorse 64 bits, but think for a second about what it would take to attack weak entropy here. For every possible entropy state: 1. Put the random number in that state 2. Use that randomness to build a RSA key pair 3. Do an RSA decryption of the captured key exchange using this key 4. See if the symmetric key we get decrypts into sensible plaintext The thing to note is that steps 2 and 3 are both expensive -- especially step 2. This isn't nearly as easy as scanning a 64-bit key on a symmetric cipher! So suppose for a second that you've got a huge data center full of machines at your disposal and you can do a billion tests per second -- a full sweep of the 64-bit space would still take 584 years. So you better hope you'd get lucky. Now would that be enough protection? Of course not -- computers get faster, and a determined enough adversary could build special hardware. (Although, again, it would be orders of magnitude more complicated than just SHA-512 bruteforcing) The point I was trying to make is that even if they were somehow only using 64 bits of entropy, a practical attack would still be difficult to mount. I'd say that each test would be at least 2^16 times more computation than a typical symmetric cipher check. Therefore I think it would be about as hard as bruteforcing a 80-bit symmetric key. In other words, 256 is way more than plenty.
veemjeem 13y ago
In general, discussion about encryption is usually bad because most people don't understand all the underlying principles of encryption. Encryption is something everyone uses so everyone has an opinion on it, but very very few people understand its implementation. When you have a blog post about encryption, 99% of the people commenting on it probably won't be making the right kind of comment.
tptacek 13y ago
No, that's not how the code works. The "256 bits" (in this case) are used as a seed for the OpenSSL CSPRNG. OpenSSL's RSA generation asks for two prime numbers each (bitlen/2) long. OpenSSL's primegen works by iterating over random numbers, here each (bitlen/2) long (of which (bitlen/2-2) are random), looking for primes.

by Ihmahr 13y ago

bodyfour 13y ago

Even 64 bits would be sufficient as long as the entropy is good. It just needs to be large enough that bruteforcing 2^N isn't feasible. 256 seems like a perfectly safe amount to me.

ryan-c 13y ago
64 bits isn't enough to provide brute force protection, you need at least 80 bits, preferably 128 bits, and 256 bits if you're paranoid.
- bodyfour 13y ago
  Yeah I should have elaborated a little more. I was in a rush. I wasn't trying to endorse 64 bits, but think for a second about what it would take to attack weak entropy here. For every possible entropy state: 1. Put the random number in that state 2. Use that randomness to build a RSA key pair 3. Do an RSA decryption of the captured key exchange using this key 4. See if the symmetric key we get decrypts into sensible plaintext The thing to note is that steps 2 and 3 are both expensive -- especially step 2. This isn't nearly as easy as scanning a 64-bit key on a symmetric cipher! So suppose for a second that you've got a huge data center full of machines at your disposal and you can do a billion tests per second -- a full sweep of the 64-bit space would still take 584 years. So you better hope you'd get lucky. Now would that be enough protection? Of course not -- computers get faster, and a determined enough adversary could build special hardware. (Although, again, it would be orders of magnitude more complicated than just SHA-512 bruteforcing) The point I was trying to make is that even if they were somehow only using 64 bits of entropy, a practical attack would still be difficult to mount. I'd say that each test would be at least 2^16 times more computation than a typical symmetric cipher check. Therefore I think it would be about as hard as bruteforcing a 80-bit symmetric key. In other words, 256 is way more than plenty.

veemjeem 13y ago

In general, discussion about encryption is usually bad because most people don't understand all the underlying principles of encryption. Encryption is something everyone uses so everyone has an opinion on it, but very very few people understand its implementation. When you have a blog post about encryption, 99% of the people commenting on it probably won't be making the right kind of comment.

tptacek 13y ago

No, that's not how the code works. The "256 bits" (in this case) are used as a seed for the OpenSSL CSPRNG. OpenSSL's RSA generation asks for two prime numbers each (bitlen/2) long. OpenSSL's primegen works by iterating over random numbers, here each (bitlen/2) long (of which (bitlen/2-2) are random), looking for primes.