Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've noticed that websites start to use 256-bit symmetric encryption, but often still end up using 2048-bit RSA keys.

http://www.keylength.com/en/3/

The link above displays the ECRYPT II recommendations, which state that 128-bit symmetric and 3248-bit asymmetric encryption have a compareable strength.

The NIST recommendations state that 128-bit symmetric is comparable to 3072-bit asymmetric encryption.

This would mean that 2048-bit RSA is weaker than 128-bit symmetric encryption. Which makes me wonder why websites are starting to offer 256-bit symmetric encryption while the weakest link (RSA) doesn't even offer 128-bit strength.

Is there anything I'm missing here?

share|improve this question

2 Answers 2

up vote 23 down vote accepted

People use 256-bit encryption because they can, and, given the choice, people tend to go for the biggest numbers, because they feel that they "deserve it".

Scientifically, it does not indeed make sense to use AES-256 when the key exchange relies on 2048-bit RSA. This is just wasted CPU cycles; AES-128 would have been equally fine. But "256" can woo auditors into submission. Such are the intricacies of the human psychology.

share|improve this answer
3  
There's also the argument that in the future someone might migrate to a higher bit strength of RSA keys, and that the configuration for the keys is decoupled from the configuration of allowed ciphers. This way the auditors can jerk off on segregation of privilege and limiting key access. –  friedkiwi Jun 18 '14 at 14:50
1  
The rule is, more is always better, right? ;) –  Alvar Jun 18 '14 at 19:00
    
It could also potentially help if a significant weakness is discovered in the symmetric encryption method which nullifies some of the entropy, there have been many unknown weaknesses in encryption algorithms which have reduced the entropy significantly but have stayed unknown for many years. Having some excess can help with this. –  Vality Jan 2 at 19:50
    
Belief that "key entropy" acts like some kind of sci-fi shield strength that is incrementally consumed by cryptanalytic attacks, is unsubstantiated. It is a common reflex to go for longer keys as if it granted some sort of "security margin", but in fact attacks don't work that way. In the case of AES and the only known non-trivial attacks (which are related-key attacks so not an immediate worry), 256-bit keys turn out to be weaker than 128-bit keys, not stronger. The only case where longer keys are actually "stronger" is against brute force, for which 128-bit keys are already strong enough. –  Tom Leek Jan 7 at 14:51

The RSA weakness only applies to the key exchange and establishing the session. If the attacker doesn't catch this, the actual communication itself is far more resistant to brute force with the 256 bit symmetric encryption. (Though both are currently way, way beyond impossible to brute force. Key reduction attacks that could come up in the future could make it a significant difference, but that isn't known now.) The RSA is the weakpoint, but that doesn't mean that it isn't worth using higher security for the persistent portion of the connection/session.

share|improve this answer
5  
Claiming that AES-256 is "more secure" than AES-128 assumes that the latter is somehow weak in some way that the former is not. As far as we know, this is not true. There is no known practical weakness of AES-128 that AES-256 does not share. Moreover, there is not really good reason to believe that AES-256 would fare better than AES-128 against future cryptanalytic results; in fact, when talking about the academic weakness known as "related keys" (no practical consequence), it works in the opposite way, AES-128 being stronger than AES-256. –  Thomas Pornin Jun 18 '14 at 15:23
    
@ThomasPornin - fair point, I update to indicate that it is simply more resistant to brute force, though both are currently well in to not brute forceable territory. As I understand it, certain exotic attacks could reduce the bits substantially though (such as certain quantum attacks), but higher key length should reduce the impact of this type of attack (even if it make it slightly more vulnerable to others). –  AJ Henderson Jun 18 '14 at 15:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.