I want to use GPG to encrypt files before storing them as backup in the cloud. I don't care about interoperability or performance/resource consumption during encryption/decription. I only care about security.

In this case, would RSA 4096 or ECC with Curve 25519 be the better choice? Which one is more secure from today's perspective? Which one will be more secure if quantum computers become a reality?

  • Are you sure that you need asymmetric encryption at all? If you want to encrypt and decrypt it yourself you may be fine with symmetric encryption. – Sjoerd Mar 18 at 10:39

If quantum computers become practical, both RSA and ECC will be completely broken. You'd need to use post-quantum cryptography to be safe in that case. Note that since these algorithms haven't received as much scrutiny as RSA or ECC, it would be unwise to trust any of them entirely. Instead, you should use two layers of encryption: one conventional and one post-quantum.

As for which is more secure otherwise, algorithms such as https://crypto.stackexchange.com/questions/31439/how-do-i-get-the-equivalent-strength-of-an-ecc-key can calculate a security level (though this is solely measuring processing time, and has no bearing on how likely a "break" of either system wuld be). Those calculations seem to indicate that RSA-4096 is slightly stronger than Curve25519.

  • 1
    This answer misses two critical factors: the first being that functional but insecure RSA implementations are significantly more easy to accidentally create than an equivalent Curve25519 implementation, and the second is that RSA performance does not scale well past 2048-bit keys (and even worse after 4096-bit) whereas Curve25519 offers significant performance benefits and has a lot of future headroom. – Polynomial Mar 17 at 21:58
  • 1
    @Polynomial The asker specifically said they don't care about performance. Also, I don't think GPG has an insecure RSA implementation. – Joseph Sible-Reinstate Monica Mar 17 at 21:59
  • 1
    I know that OP said they didn't care about performance, but performance is a critical factor in the future scaling of the algorithm, which is of significant importance in the context of longevity. For example, RSA-8192 is practically prohibitive due to performance issues. Stating that GPG's implementation of RSA is unequivocally secure is also not true in a practical sense, since it is known to be vulnerable to a number of power analysis attacks and likely does not offer strong security against cache attacks. Curve25519 is, generally speaking, inherently more secure in these contexts. – Polynomial Mar 17 at 22:03
  • 1
    I agree with most of your answer, but I am concerned that your final statement suggests that RSA should be used over Curve25519 because of the theoretical strength calculations. There are many practical security and performance reasons to use Curve25519 (or rather Ed25519 / X25519, since Curve25519 is just the curve definition) over RSA, and RSA is generally a problematic algorithm - many cryptographers consider it to have an excessive number of implementation footguns. – Polynomial Mar 17 at 22:06
  • @JosephSible Your impression of the quality of GPG's engineering—and especially of its resistance to side channels—may be a little elevated from the unfortunate reality… – Squeamish Ossifrage Nov 10 at 4:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.