Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've noticed that websites start to use 256-bit symmetric encryption, but often still end up using 2048-bit RSA keys.

http://www.keylength.com/en/3/

The link above displays the ECRYPT II recommendations, which state that 128-bit symmetric and 3248-bit asymmetric encryption have a compareable strength.

The NIST recommendations state that 128-bit symmetric is comparable to 3072-bit asymmetric encryption.

This would mean that 2048-bit RSA is weaker than 128-bit symmetric encryption. Which makes me wonder why websites are starting to offer 256-bit symmetric encryption while the weakest link (RSA) doesn't even offer 128-bit strength.

Is there anything I'm missing here?

share|improve this question

2 Answers 2

up vote 21 down vote accepted

People use 256-bit encryption because they can, and, given the choice, people tend to go for the biggest numbers, because they feel that they "deserve it".

Scientifically, it does not indeed make sense to use AES-256 when the key exchange relies on 2048-bit RSA. This is just wasted CPU cycles; AES-128 would have been equally fine. But "256" can woo auditors into submission. Such are the intricacies of the human psychology.

share|improve this answer
2  
There's also the argument that in the future someone might migrate to a higher bit strength of RSA keys, and that the configuration for the keys is decoupled from the configuration of allowed ciphers. This way the auditors can jerk off on segregation of privilege and limiting key access. –  friedkiwi Jun 18 at 14:50
1  
The rule is, more is always better, right? ;) –  Alvar Jun 18 at 19:00

The RSA weakness only applies to the key exchange and establishing the session. If the attacker doesn't catch this, the actual communication itself is far more resistant to brute force with the 256 bit symmetric encryption. (Though both are currently way, way beyond impossible to brute force. Key reduction attacks that could come up in the future could make it a significant difference, but that isn't known now.) The RSA is the weakpoint, but that doesn't mean that it isn't worth using higher security for the persistent portion of the connection/session.

share|improve this answer
5  
Claiming that AES-256 is "more secure" than AES-128 assumes that the latter is somehow weak in some way that the former is not. As far as we know, this is not true. There is no known practical weakness of AES-128 that AES-256 does not share. Moreover, there is not really good reason to believe that AES-256 would fare better than AES-128 against future cryptanalytic results; in fact, when talking about the academic weakness known as "related keys" (no practical consequence), it works in the opposite way, AES-128 being stronger than AES-256. –  Thomas Pornin Jun 18 at 15:23
    
@ThomasPornin - fair point, I update to indicate that it is simply more resistant to brute force, though both are currently well in to not brute forceable territory. As I understand it, certain exotic attacks could reduce the bits substantially though (such as certain quantum attacks), but higher key length should reduce the impact of this type of attack (even if it make it slightly more vulnerable to others). –  AJ Henderson Jun 18 at 15:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.