0

I'm following advice from here about how to encrypt a long text in java. As encrypting a long text directly using a 2048 bit key is not possible, the advice is to create a 128 bit key encryption key, then use it with AES to encrypt the long text. Then use the 2048 bit key from keystore to encrypt the 128 bit AES key and send/save the encrypted key and the long encrypted text together.

My question is..

Isn't the weakest link in the chain the 128 bits? Why can't an attacker (brute force) try to break the 128 bit key directly and just decrypt the long text with it? How to encrypt the long text with 2048 bit key so that the long text would have 2048 bits of security?

  • "use the 2048 bit key from keystore to sign the 128 bit AES key" - I really hope you mean encrypt and not sign – AndrolGenhald May 4 '18 at 13:50
3

No, 2048 bit RSA key is way way weaker than 128 bit AES key. It may sound that the RSA key should be stronger, because it has more bits, but that is not the case. The reason for that is RSA key has to be product of two prime numbers while AES key can be completely random.

  • thanks for your quick answer, so the step of 2048 RSA encryption of AES key is just to send besided the encrypted text... some way to add security on this step? if is just to save on server and obfuscated, case of server compromise, there is another way to do it? – Rogelio May 4 '18 at 10:16
  • it seems that the weakest link is the key to access the keystore... – Rogelio May 4 '18 at 10:22
  • and that my appreciation about the 2 encryptions being totally independent was true, at last – Rogelio May 4 '18 at 10:28
  • @Rogelio I don't understand your question, what do you mean add security to this step? If 2048 bit RSA key is not strong enough for you, you can increase it to 4096 bit. Otherwise I don't see what you would want to improve there... – Peter Harmann May 4 '18 at 10:49
  • thanks a lot, that's all, I'll ask another question on how to increase security on server on the key to access the keystore? – Rogelio May 4 '18 at 11:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.