# Which AES key length to choose for OpenVPN?

I plan on using OpenVPN on client devices which are small embedded machines, so I must balance between speed and security.

The OpenVPN documentation says that it is "general wisdom that 1024-bit keys are no longer sufficient". This refers to the asymetric keys used for the key exchange.

I should now choose an encryption method. My first thought is to take AES-128, but I'm not sure whether this is (in the "general wisdom" sense) still secure enough for the upcoming (10?) years.

Is there a consensus on this point?

In particular for OpenVPN: are other things more security relevant than the AES key size?

AES key size and RSA key size do not relate to the same thing.

RSA, DSA, Diffie-Hellman... are algorithms involved in the initial steps of key exchange, and they come from asymmetric cryptography, which uses a lot of mathematical structure (big integers with special characteristics) to achieve its goals. That structure is what makes them run at all, but it also is their weakness, since it can be leveraged to break them. To avoid that, these algorithms must use very big integers, traditionally 1024 bits or more. Some people consider that 1024 bits are no longer sufficient because computers get faster over time.

AES is symmetric cryptography, which is conceptually simpler: the same key is used to encrypt and to decrypt. There is no mathematical structure here, only a bunch of bits. The attacker has no leverage, and his only recourse is to try all possible keys (that's called "brute force"). 128 bits are more than enough to defeat brute force.

To make an analogy, a RSA key is a wall made of sand, while an AES key is made of steel. Both can be strong enough to block an incoming rocket, but in the case of sand you will need more of the stuff.

AES accepts three key sizes (128, 192 and 256 bits); all three are fine. In fact, 128 bits are slightly better because AES-128 is slightly faster than AES-192 and AES-256.

``````The attacker has no leverage, and his only recourse is to try all possible keys (that's called "brute force").
``````

That assumes a perfect cipher, one that cannot be weakened. It's a dangerous way of thinking, forgoing a sane security margin.

• When the next version of OpenVPN comes out, switch to ECDHE.
• Use AES-256 because cpu cycles are cheap.
• Use RSA, not DSA.
• Use an RSA key size of 2048 bits or more, but no less.
• Initial connection times will be slower if you chose a large keysize eg. 4096 bits, but the wait will depend on hardware.