7

I want to use GPG to encrypt files before storing them as backup in the cloud. I don't care about interoperability or performance/resource consumption during encryption/decription. I only care about security.

In this case, would RSA 4096 or ECC with Curve 25519 be the better choice? Which one is more secure from today's perspective? Which one will be more secure if quantum computers become a reality?

Improve this question
1
  • 2
    Are you sure that you need asymmetric encryption at all? If you want to encrypt and decrypt it yourself you may be fine with symmetric encryption.
    – Sjoerd
    Mar 18, 2019 at 10:39

3 Answers 3

Reset to default
6

RSA and ECC are asymmetric encryption algorithms which are considered by experts to be the types of algorithms relatively easier to break by quantum than symmetric encryption standards.

For file encryption and storage you should therefore take a better look either at AES256 or Serpent. Both are symmetric.

two Quotes by the expert Daniel Bernstein:

"In contrast to the threat quantum computing poses to current public-key algorithms, most current symmetric cryptographic algorithms and hash functions are considered to be relatively secure against attacks by quantum computers."

"While the quantum Grover's algorithm does speed up attacks against symmetric ciphers, doubling the key size can effectively block these attacks."

Improve this answer
2
  • Until proven otherwise I consider quantum computing a scam. At most it is something with very limited application. Assuming QC will work against current encryption, I will just use more of fractal encryption and I'm fine anyway.
    – Overmind
    Mar 12, 2020 at 16:14
  • While it's true that both these algorithms are susceptible to quantum computing, we're a LONG way from breaking RSA 4096. The realities are more like decades, possibly much longer before this becomes feasible.
    – Steve Sether
    Mar 12, 2020 at 17:55
2

RSA and ECC are asymmetric encryption algorithms used for remote key exchange. Why would you encrypt your own local files with something that uses private and public keys? Probably you would use AES in this case.

Improve this answer
1
  • They are both used in remote key exchange and for things such as signing files and encrypting [email] messages for verification of source. However, the point still remains that they are simply not the goto choice for local file encryption (in fact they shouldn't even come to mind for it). For this reason, that your answer specifically makes that part clear and offers a more purpose appropriate encryption (AES) - while also making clear that RSA or ECC are relatively no better than each other for such an odd purpose; I think this answer is more directly correct.
    – Rik
    Jun 1, 2022 at 13:54
1

If quantum computers become practical, both RSA and ECC will be completely broken. You would need to use post-quantum cryptography to be safe in that case. Note that since these algorithms haven't received as much scrutiny as RSA or ECC, it would be unwise to trust any of them entirely. Instead, you should use two layers of encryption: one conventional and one post-quantum.

As for which is more secure otherwise, algorithms such as https://crypto.stackexchange.com/questions/31439/how-do-i-get-the-equivalent-strength-of-an-ecc-key can calculate a security level (though this is solely measuring processing time, and has no bearing on how likely a "break" of either system would be). Those calculations seem to indicate that RSA-4096 is slightly stronger than Curve25519.

Improve this answer
5
  • 2
    This answer misses two critical factors: the first being that functional but insecure RSA implementations are significantly more easy to accidentally create than an equivalent Curve25519 implementation, and the second is that RSA performance does not scale well past 2048-bit keys (and even worse after 4096-bit) whereas Curve25519 offers significant performance benefits and has a lot of future headroom.
    – Polynomial
    Mar 17, 2019 at 21:58
  • 1
    @Polynomial The asker specifically said they don't care about performance. Also, I don't think GPG has an insecure RSA implementation.
    – Joseph Sible-Reinstate Monica
    Mar 17, 2019 at 21:59
  • 2
    I know that OP said they didn't care about performance, but performance is a critical factor in the future scaling of the algorithm, which is of significant importance in the context of longevity. For example, RSA-8192 is practically prohibitive due to performance issues. Stating that GPG's implementation of RSA is unequivocally secure is also not true in a practical sense, since it is known to be vulnerable to a number of power analysis attacks and likely does not offer strong security against cache attacks. Curve25519 is, generally speaking, inherently more secure in these contexts.
    – Polynomial
    Mar 17, 2019 at 22:03
  • 3
    I agree with most of your answer, but I am concerned that your final statement suggests that RSA should be used over Curve25519 because of the theoretical strength calculations. There are many practical security and performance reasons to use Curve25519 (or rather Ed25519 / X25519, since Curve25519 is just the curve definition) over RSA, and RSA is generally a problematic algorithm - many cryptographers consider it to have an excessive number of implementation footguns.
    – Polynomial
    Mar 17, 2019 at 22:06
  • @JosephSible Your impression of the quality of GPG's engineering—and especially of its resistance to side channels—may be a little elevated from the unfortunate reality…
    – Squeamish Ossifrage
    Nov 10, 2019 at 4:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .