5

What is more secure? An RSA-2048 key or a cryptographic 64 characters-long random HEX password?

I am asking this because as far as I understand, since the RSA-2048 key is a mathematical key, a quantum computer can crack it pretty easily. But, I believe it would be almost impossible for it to guess or crack a 64 chars-long cryptographic HEX password I have generated randomly.

2
  • 5
    Don't worry about quantum computers until they can actually affect security. Focus on following good security practices and don't blaze your own security trail.
    – ztk
    Commented Feb 15, 2017 at 18:19
  • 4
    If I trick you into connecting to my server instead of your one, the password now has zero bits of entropy because I know it. Commented Feb 16, 2017 at 3:38

2 Answers 2

13

Quantum computing is not yet a reality, so it is premature for you to invest resources in combating this ahead of the SSH standard.

Assuming identity of the server is verified, both options are equally secure, as they are both stored in a file on the client computer, and both have a sufficiently large amount of entropy.

If you accidentally connect to the wrong SSH server, the Private Key approach is more secure.

Personally, I'd go for both approaches combined. Include a private key, as well as a not-so-long password which you can remember. This way if your Private Key is stolen (e.g. physical access), the attacker still needs your password.

2
  • 2
    Since contrary to the password the private key is not exposed during the SSH handshake your argumentation about the better security of key based authentication when connecting to the wrong server is correct. Commented Feb 15, 2017 at 18:32
  • 1
    nvlpubs.nist.gov/nistpubs/SpecialPublications/… contains a table containing comparable strengths of key sizes, and describes 2048-bit RSA as equivalent to 112-bits.
    – Scovetta
    Commented Feb 15, 2017 at 20:01
2

Passwords should never be used If possible. Private keys will prevent man in the middle attacks which passwords are susceptible to, amongst other things. If it's possible to crack a private key, the password is also completely broken since this method of authentication relies on the servers public key to initiate the session.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .