4 ms·
Using 4096-bit RSA for the end-entity certificate is pointless. First, it's unlikely that an attacker will ever be able to break 2048-bit RSA but not 4096-bit
by agwa 12y ago
Using 4096-bit RSA for the end-entity certificate is pointless. First, it's unlikely that an attacker will ever be able to break 2048-bit RSA but not 4096-bit RSA, either in the near or distant future. But for the sake of discussion, let's assume that such an attacker exists. Since nearly all clients will use forward secrecy with ECDH when connecting to eff.org, the attacker will need to conduct an active attack, and forge a certificate, to take advantage of their RSA breaking ability. But a 4096-bit end entity certificate will not hinder them, because there are plenty of trusted CAs (including the one that signed eff.org) which use 2048-bit RSA keys. So this hypothetical attacker, instead of factoring EFF's 4096-bit RSA key, will just factor a CA's 2048-bit RSA key, which is what they would do anyways, since factoring a CA key allows impersonation of any website, not just one.
So all that 4096-bit RSA accomplishes here is to slow down the handshake and increase computational load on their web servers.
- QUFB 12y agoNot necessarily - HPKP is standardized, here now, and supported by Firefox and Chrome. http://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning http://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
- agwa 12y agoTrue, pinning the end-entity cert would require the attacker to factor the end-entity cert. But pinning the end-entity cert is like pointing a loaded gun at your foot (if you lose the key, and all your backups, you are screwed), and EFF isn't even doing it. And it would still boil down to a big performance sacrifice (which gives SSL a bad reputation) for a flawed premise.
- rjaco31 12y agoFrom the Mozilla page: >Note: The current specification requires including a second pin for a backup key which isn't yet used in production. This allows for changing the server's public key without breaking accessibility for clients that have already noted the pins. This is important for example when the former key gets compromised.
- tyho 12y agoYou cannot get an A+ on SSL Labs without 4096 bit cert. It is just a vanity thing IMHO.
- agwa 12y agoNot true. My sites have an A+ on SSL Labs with a 2048-bit RSA cert. Edit: you may be thinking of one of the numeric scores, which probably requires 4096-bit RSA to max out. But you'd be best served ignoring the numeric scores and just focusing on the letter grade. You really do not need a 4096-bit end-entity RSA key to have "A+"-level security.
- Panino 12y agoTo expand on agwa's point, I recently received an A+ with a 3072-bit cert. The site config was TLS 1.2-only, with only 256-bit FS ciphers, and HSTS. But I re-enabled TLS 1/1.1 for better browser/crawler support, which dropped the grade down to A.
- toast0 12y agoYou need HTTP Strict Transport Security to get an A+, a 2048-bit cert is fine.
- ytch 12y agoFrom this document: https://www.ssllabs.com/downloads/SSL_Server_Rating_Guide.pdf https://www.ssllabs.com/downloads/SSL_Server_Rating_Guide.pd... Keys below 2048 bits (e.g., 1024) are now considered weak, and the grade capped at B. New grade A+ is introduced for servers with exceptional configurations. At the moment, this grade is awarded to servers with good configuration, no warnings, and HTTP Strict Transport Security support with a max-age of at least 6 months. Therefore A+ means key length>=2048 with other good config (TLS 1.2 and so on) and HSTS max-age>=6 month.
- deleted 12y ago[deleted]