3

I want to use GPG to encrypt files before storing them as backup in the cloud. I don't care about interoperability or performance/resource consumption during encryption/decription. I only care about security.

In this case, would RSA 4096 or ECC with Curve 25519 be the better choice? Which one is more secure from today's perspective? Which one will be more secure if quantum computers become a reality?

  • 2
    Are you sure that you need asymmetric encryption at all? If you want to encrypt and decrypt it yourself you may be fine with symmetric encryption. – Sjoerd Mar 18 '19 at 10:39
2

RSA and ECC are asymmetric encryption algorithms which are considered by experts to be the types of algorithms relatively easier to break by quantum than symmetric encryption standards.

For file encryption and storage you should therefore take a better look either at AES256 or Serpent. Both are symmetric.

two Quotes by the expert Daniel Bernstein:

"In contrast to the threat quantum computing poses to current public-key algorithms, most current symmetric cryptographic algorithms and hash functions are considered to be relatively secure against attacks by quantum computers."

"While the quantum Grover's algorithm does speed up attacks against symmetric ciphers, doubling the key size can effectively block these attacks."

| improve this answer | |
  • Until proven otherwise I consider quantum computing a scam. At most it is something with very limited application. Assuming QC will work against current encryption, I will just use more of fractal encryption and I'm fine anyway. – Overmind Mar 12 at 16:14
  • While it's true that both these algorithms are susceptible to quantum computing, we're a LONG way from breaking RSA 4096. The realities are more like decades, possibly much longer before this becomes feasible. – Steve Sether Mar 12 at 17:55
1

RSA and ECC are asymmetric encryption algorithms used for remote key exchange. Why would you encrypt your own local files with something that uses private and public keys? Probably you would use AES in this case.

| improve this answer | |
1

If quantum computers become practical, both RSA and ECC will be completely broken. You would need to use post-quantum cryptography to be safe in that case. Note that since these algorithms haven't received as much scrutiny as RSA or ECC, it would be unwise to trust any of them entirely. Instead, you should use two layers of encryption: one conventional and one post-quantum.

As for which is more secure otherwise, algorithms such as https://crypto.stackexchange.com/questions/31439/how-do-i-get-the-equivalent-strength-of-an-ecc-key can calculate a security level (though this is solely measuring processing time, and has no bearing on how likely a "break" of either system would be). Those calculations seem to indicate that RSA-4096 is slightly stronger than Curve25519.

| improve this answer | |
  • 1
    This answer misses two critical factors: the first being that functional but insecure RSA implementations are significantly more easy to accidentally create than an equivalent Curve25519 implementation, and the second is that RSA performance does not scale well past 2048-bit keys (and even worse after 4096-bit) whereas Curve25519 offers significant performance benefits and has a lot of future headroom. – Polynomial Mar 17 '19 at 21:58
  • 1
    @Polynomial The asker specifically said they don't care about performance. Also, I don't think GPG has an insecure RSA implementation. – Joseph Sible-Reinstate Monica Mar 17 '19 at 21:59
  • 1
    I know that OP said they didn't care about performance, but performance is a critical factor in the future scaling of the algorithm, which is of significant importance in the context of longevity. For example, RSA-8192 is practically prohibitive due to performance issues. Stating that GPG's implementation of RSA is unequivocally secure is also not true in a practical sense, since it is known to be vulnerable to a number of power analysis attacks and likely does not offer strong security against cache attacks. Curve25519 is, generally speaking, inherently more secure in these contexts. – Polynomial Mar 17 '19 at 22:03
  • 2
    I agree with most of your answer, but I am concerned that your final statement suggests that RSA should be used over Curve25519 because of the theoretical strength calculations. There are many practical security and performance reasons to use Curve25519 (or rather Ed25519 / X25519, since Curve25519 is just the curve definition) over RSA, and RSA is generally a problematic algorithm - many cryptographers consider it to have an excessive number of implementation footguns. – Polynomial Mar 17 '19 at 22:06
  • @JosephSible Your impression of the quality of GPG's engineering—and especially of its resistance to side channels—may be a little elevated from the unfortunate reality… – Squeamish Ossifrage Nov 10 '19 at 4:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.