3

OpenVPN recommends using a 2048 RSA key size for greater security, however, the hardware I'm using is somewhat weak and defaults to using a 1024 RSA key size. I'm trying to determine if it's worth the hassle of manually changing things to a 2048 sized key. I'm not concerned about anyone eavesdropping on any data being send over the VPN connection, however, I am concerned about someone opening a VPN connection themselves that isn't authorized to do so. So I'm wondering, does the key size impact only how difficult it is to eavesdrop on an authorized connection, or does it also make a difference in how hard it is to gain access if you're not authorized to do so.

0

There's a few misconceptions in your question - I'll try to help:

OpenVPN recommends using a 2048 RSA key size for greater security, however, the hardware I'm using is somewhat weak and defaults to using a 1024 RSA key size.

Larger RSA key sizes give you better security specifically at authentication and key exchange. And your hardware needs to be very weak not to handle 2048 bit keys. (I will try to find actual data around this, though I'd suggest an old Pentium II would handle an RSA 2048 within reasonable time.) So my guess is that your hardware will handle RSA/2048 bits just fine.

I'm trying to determine if it's worth the hassle of manually changing things to a 2048 sized key. I'm not concerned about anyone eavesdropping on any data being send over the VPN connection ...

So you don't need a VPN?

I am concerned about someone opening a VPN connection themselves that isn't authorized to do so.

This is a reasonable concern, though not something that relates to your RSA key size directly. Or not at this level. It's far far easier to attack an existing client than to brute force even a relatively short RSA key.

  • Ehm. I think this is not right: The server's RSA key is actually used to authenticate the server (so clients can verify they connect to the correct server) and the client's RSA key is used to authenticate the client (so no unwanted participant can connect). There are alternative way to authenticate clients, but using certificates (where the RSA keys are a part of) is the default. – S. Biewald Jun 25 '20 at 19:32
  • You are right, I overlooked this aspect of the RSA handshake. – Pedro Jun 25 '20 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.