PGP is 2048 bit encryption? That a whole lot more than 128 bits. But, I thought 128 bits is more "serious" and "legit"

  • 3
    The short version is, "good" key lengths for Asymmetric keys are different than "good" key lengths for Symmetric keys. 2048 is a reasonable minimum for Asymmetric keys, and 128 is a reasonable minimum for Symmetric keys (depending on the algorithm).
    – gowenfawr
    Jan 4 '19 at 19:34
  • 2
    More specifically, "good" key lengths are unique to the cipher being used. Symmetric keys are generally unstructured random numbers and need to be resistant to brute force so 128 or 256 bit keys are common. Asymmetric schemes tend to use larger keys, as they often contain internal structure. For instance, RSA private keys consist of two large randomly-chosen primes and are significantly larger at 2,048 or 4,096 bits. For ECC keys—such as curve25519—256-bit keys are used, which provides security equivalent to 128 bits. For the McEliece cryptosystem, keys can be as large as 8,373,911 bits. Jan 4 '19 at 19:59

There are two different concepts at play here:

Key Size is the size of a key on disk, measured in bits. For RSA encryption you tend to see key sizes like 2048 bit, 4096 bit, etc. For Elliptic Curve Cryptography (ECC), you tend to see key sized like 224 bit, 256 bit, 384 bit etc. For AES, 128 bit, 256 bit.

Key Strength is a measure of how much computation an attacker needs to do to break your key (ie compute the private key from the public key). In crypto research papers you tend to see sentences like this:

Breaking an RSA 2048 key requires, on average, 2112 operations.

This key is said to have "112-bit security".

Symmetric block ciphers like AES tend to have the property that the key length is the same as their security level (note that this will no longer be true once quantum computers are here). Here is a table from NIST that shows relative security levels for various RSA and ECC key sizes.

Table comparing security levels of DH and ECDH

Of course, as mathematical research progresses and we find more efficient ways of attacking the underlying math, the number of bits of security provided by your 2048-bit key will go down.

Why 128-bit security?

For an intuition on how long it would take you to make 2128 guesses at something, check out this youtube video:

How secure is 256 bit security?

Cryptographers like things that have >= 128-bit security because it's comfortably in the "not in my lifetime" category. When something gets below 80 bits of security we start looking for something bigger to replace it with.

  • 1
    Small nitpick, but 192 and 224-bit ECC is typically no longer permitted. I believe 256 is the minimum for NIST.
    – forest
    Jan 4 '19 at 21:16
  • Is that a nitpick? According to that table, you'd need >= 256 to get 128 bit security. Is it possible to look up the NIST standards at the moment, or do we have to wait for the US government to stop throwing a temper tantrum? Jan 4 '19 at 21:18
  • I just recall reading that Bluetooth 2.1 uses P-192 and that it is lower than what is currently permitted.
    – forest
    Jan 4 '19 at 21:32
  • p̶e̶r̶m̶i̶t̶t̶e̶d̶ recommended; for those of us who work outside of the US federal government, NIST is merely a suggestion :P Jan 4 '19 at 21:36
  • It is generally believed that symmetric encryption such as AES will be reduced to 1/2 the number of bits under a quantum attack. This 256-bit AES would degrade to 128-bit and still be secure under a quantum attack.
    – zaph
    Jan 5 '19 at 3:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.