I'm following advice from here about how to encrypt a long text in Java.

As encrypting a long text directly using a 2048 bit key is not possible, the advice is to create a 128 bit key encryption key, then use it with AES to encrypt the long text. Then use the 2048 bit key from keystore to encrypt the 128 bit AES key and send/save the encrypted key and the long encrypted text together.

My question is: Isn't the weakest link in the chain the 128 bits? Why can't an attacker (brute force) try to break the 128 bit key directly and just decrypt the long text with it? How to encrypt the long text with 2048 bit key so that the long text would have 2048 bits of security?

  • "use the 2048 bit key from keystore to sign the 128 bit AES key" - I really hope you mean encrypt and not sign Commented May 4, 2018 at 13:50

1 Answer 1


No, 2048 bit RSA key is weaker than 128 bit AES key. It may sound that the RSA key should be stronger, because it has more bits, but that is not the case. The reason for that is RSA key has to be product of two prime numbers while AES key can be completely random.

  • thanks for your quick answer, so the step of 2048 RSA encryption of AES key is just to send besided the encrypted text... some way to add security on this step? if is just to save on server and obfuscated, case of server compromise, there is another way to do it? Commented May 4, 2018 at 10:16
  • it seems that the weakest link is the key to access the keystore... Commented May 4, 2018 at 10:22
  • and that my appreciation about the 2 encryptions being totally independent was true, at last Commented May 4, 2018 at 10:28
  • @Rogelio I don't understand your question, what do you mean add security to this step? If 2048 bit RSA key is not strong enough for you, you can increase it to 4096 bit. Otherwise I don't see what you would want to improve there... Commented May 4, 2018 at 10:49
  • thanks a lot, that's all, I'll ask another question on how to increase security on server on the key to access the keystore? Commented May 4, 2018 at 11:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .