2048 bit SSH RSA public key vs AWS KMS-encrypted text in source control

Question

I'm trying to work out how acceptable it is to commit KMS-encrypted API keys to source control. It is (I believe) often deemed acceptable to commit public keys to source control. So, to try to compare to this...

From an 2048 bit RSA SSH public key:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCdvc0yfmzJrChkfji4n4kLFVaBBvs7Dkx9UnspvY2FU4m7dUh1x7e+EAVCsXpO59Q1pJ4uJRvQJSS2eXvt1fLoRFemvVbcxO97DkljzUAdLIdv5+8AAEr4wluIkKV5Pt3mnrqgyP0r9hmb8OGp2J1uejEZhJ5POlmqi2e40LYb0IU4ajm3ntrXIfm7gkSxWjJW4glA4/2wd7AgiuSEitrV2S1RQBagHkRWFGi8CbtduXQeXW/BVtru0lZykCPtpzl39UQmuwzc+qgkT8fXmXTpocUURwYrSuky49eRrfepzR4cio1s/D4HrRhZ/2/eM/q+SaPNoNas9QjHWeyWEk53 test@test.com

and an AWS KMS-encrypted string, that was 40 characters in plaintext:

AQICAHh3zfBq68IrUAP7QND8usbFznzDgT4C9Y3RnCqLOHGEpQHVWukfLRjVSHSgQaPDi1TPAAAAhzCBhAYJKoZIhvcNAQcGoHcwdQIBADBwBgkqhkiG9w0BBwEwHgYJYIZIAWUDBAEuMBEEDOjRSAkJHX2LtJ4HbwIBEIBDDTeGCBzhm13tJYLkBK/5EEsBhwG2Q8IzrUMfbBbrmbjtmZSULlXLnACctUaMNg+OuZFpNAkxqdIbE621UcZ6MtEDNw==

which is harder: finding the private key from the public key, or decrypting the 40 character string? How long would each take, given, say, a single modern core?

How different would this be if the SSH key were 4096 bits?

Answer 1

which is harder: finding the private key from the public key, or decrypting the 40 character string? How different would this be if the SSH key were 4096 bits?

I believe you are asking the wrong question. Mandatory XKCD:

For all practical purposes, hacks are the result of hackers getting root access to the server or data due to weak passwords or unpatched software. It's almost never the case that the crypto gets broken.

---

The question you should be asking is: which method has more risk of revealing the data through server compromise, insider threat, or some careless accident? ie Which of the following do you have higher trust in remaining secure?

• a blob of data that can only be decrypted by AWS KMS, or
• a private key file stored < where ever you've stored your private key >

AWS KMS is generally a good solution, unless your AWS account has many admins, or you're concerned about AWS employees having access, or the data being protected by that key has legal data-residency concerns, etc.