Is a certificate with more bits than its parent more secure?

Question

Let's Encrypt currently issues 4096 bit RSA certificates if requested (default, however, is 2048). But its parents, intermediate "Let's Encrypt Authority X3" and root "DST Root CA X3", are both 2048 bit.

According to this thread, the well-known Qualys SSL Labs test gives a setup with 4096 bit Let's Encrypt certificate a better rating (in "Key Exchange" section) than to 2048 bit one. Why? Isn't a certificate chain as weak as the weakest link?

Answer 1

Neither 2048 nor 4096 bit RSA can currently be broken. Thus the question is how it affects the security of the data if the attacker sniffs the data today but manages to break the keys in the future:

• The keys of the CA are only needed to validate the certificate chain. The compromise of the keys which are used for establishing a connection does not make it possible to decrypt sniffed data.
• The key of the leaf certificate is used to authenticate the server which is not a problem either if the key gets compromised later.
• If RSA key exchange is used instead of the recommended DH/ECDH key exchange the key in the leaf certificate is used to protect the exchanged symmetric keys. Compromise of the RSA key will allow to remove this protection on sniffed data and thus makes it possible to decrypt sniffed traffic. In this case RSA-4096 will give more security than RSA-2048 because the efforts needed to break it are much higher. But, in practice the attacker will probably try to get to the private key not by breaking RSA but by compromising the system where the private key is stored or by using the law to get to the key. In this case RSA-2048 and RSA-4096 both provide the same security.

In summary: RSA-2048 is enough for CA certificates today. Use of RSA-4096 in a leaf certificate might in theory better than RSA-2048. In practice it is only better if RSA key exchange is used. But using this key exchange instead of DH/ECDH is not a good idea anyway because the private key of the certificate might be compromised in easier ways apart from cracking RSA.

Answer 2

It completely depends, because security isn't just about bits. Its also about other controls and precautions. Its about how secure the systems are against physical and other access.

1536 or 2048 bits is still generally pretty hard to break if the CA is a 100% offline terminal in a vault.

But a 16384 bit ubersecure key cert issued under it is far more breakable if its issuing system unfortunately isn't well secured, or the network lets me read its private cert, or it's processed using side channels a malefactor can access, etc.

Conversely the CA that uses 2048 may not be ideal to sign for a well secured 4096 bit key you create... But it may still be worth you using 4096 if you figure its one less point of weakness going forward, or any number of other reasons.