Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Today while I'm reading about the RSA factoring challenge. I thought to myself that if whoever depends on RSA-512 (By using TLS_RSA_xxxx) to secure their TLS connection years ago, the info they wish to protect will not be secured anymore today. Therefore, if someone manage to crack it in the future, I think the same goes for RSA-1024 or 2048.

So let's assume if we want to secure our TLS protected data like forever, is PFS the way to go?

share|improve this question
up vote 2 down vote accepted

PFS is about resistance to key-compromise, not about growing computational power.

If you're afraid of faster conventional computers, use sufficient key-sizes. e.g. a 4096 bit RSA key or a 256 to 512 bit ECC key. At least for the 512 bit ECC key case, we can safely say that conventional computers getting faster is no threat.

Unfortunately large RSA keys become pretty slow, so at high security levels ECC is preferable.

For SSL the easiest way to get ECC for confidentiality is using the forward secure ECDHE suites. But that those suites offer both PFS and higher security levels is merely coincidental, the security level in bits and PFS are not directly related.

=> Go with ECDHE suites where available. They offer both PFS and higher security levels with decent performance.

For long term security, I'd worry more about quantum computers, which kill both ECC and RSA using Shor's algorithm and about mathematical advances which might break either of them, or both.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.