5

What is more secure? An RSA-2048 key or a cryptographic 64 characters-long random HEX password?

I am asking this because as far as I understand, since the RSA-2048 key is a mathematical key, a quantum computer can crack it pretty easily. But, I believe it would be almost impossible for it to guess or crack a 64 chars-long cryptographic HEX password I have generated randomly.

Improve this question
2
  • 5
    Don't worry about quantum computers until they can actually affect security. Focus on following good security practices and don't blaze your own security trail. – ztk Feb 15 '17 at 18:19
  • 4
    If I trick you into connecting to my server instead of your one, the password now has zero bits of entropy because I know it. – user253751 Feb 16 '17 at 3:38
13

Quantum computing is not yet a reality, so it is premature for you to invest resources in combating this ahead of the SSH standard.

Assuming identity of the server is verified, both options are equally secure, as they are both stored in a file on the client computer, and both have a sufficiently large amount of entropy.

If you accidentally connect to the wrong SSH server, the Private Key approach is more secure.

Personally, I'd go for both approaches combined. Include a private key, as well as a not-so-long password which you can remember. This way if your Private Key is stolen (e.g. physical access), the attacker still needs your password.

Improve this answer
2
  • 2
    Since contrary to the password the private key is not exposed during the SSH handshake your argumentation about the better security of key based authentication when connecting to the wrong server is correct. – Steffen Ullrich Feb 15 '17 at 18:32
  • 1
    nvlpubs.nist.gov/nistpubs/SpecialPublications/… contains a table containing comparable strengths of key sizes, and describes 2048-bit RSA as equivalent to 112-bits. – Scovetta Feb 15 '17 at 20:01
2

Passwords should never be used If possible. Private keys will prevent man in the middle attacks which passwords are susceptible to, amongst other things. If it's possible to crack a private key, the password is also completely broken since this method of authentication relies on the servers public key to initiate the session.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.