What does the pgp public key length depend on? Does a long private key result in a long public key? The longer public key the better; or is it even the private key the crucial factor?
The "length" is a formal characterization of one of the mathematical values that constitute the key pair. Thus, the public and the private key don't have independent lengths per se; the private/public key pair has a length, which, by extension, is also said to be the length of the public key and of the private key.
The length is not the actual bit length of the encoding of either the public or private key, although there are correlations.
For instance, a RSA key pair consists in the following elements:
- A prime integer p
- Another private integer q
- The "modulus" n which is equal to the product of p and q
- The "public exponent" e (a usually small integer, often 65537 by Tradition)
- The "private exponent" d (a bigger integer, computed such that e*d = 1 modulo p-1 and also modulo q-1)
- The value dp = d mod p-1
- The value dq = d mod q-1
- The value q-1 which is the inverse of q modulo p
The RSA key length is the size of the modulus n: when we say that the key has length "2048 bits", we really mean that 22047 < n < 22048.
The RSA public key consists in n and e. When encoded, it is thus somewhat bigger (in bits) than n, since it must have room for e as well.
The RSA private key consists in p, q, n, e, d, dp, dq and q-1. Thus, it contains the same n as the public key, and therefore has intrinsically the same "length". (Technically, with only n and d, you can do the same operations, but the other values allow for about four times faster processing, and better resistance to side-channel leakage, which is why the standard RSA private keys contain all eight integer values.)
The key strength is somewhat impacted by the length. When n is too small, it is technologically feasible to recover p and q from n (this is known as integer factorization), at which point all the private key elements can be recomputed. Thus, a larger key (meaning, a longer modulus n) makes for better security, up to some point. Indeed, when the key is so large that integer factorization is completely out of question, now and for the foreseeable future, then the key won't be broken, and increasing its length any further does not practically change the security (there is nothing less breakable than unbreakable). On the other hand, larger keys imply higher costs (storage, network bandwidth, CPU) so you don't want to overdo it. 2048-bit RSA keys are fine for now and the next 30 years as well; beyond that, future is not really "foreseeable".
Key length is not the only factor for security; it must be also properly generated and used. Side-channel attacks are, in practice, a much more plausible attack path than upfront integer factorization.
For other algorithms such as ElGamal or ECDSA, the mathematical objects are of a different nature, but the same concepts apply:
- The "length" is that of the key pair and relates to one of the mathematical elements that both public and private key share.
- Longer keys mean higher security (up to the point of unbreakability), and higher usage costs.
The length of the private key determines the length of the public key material. The actual public key that you'll see on a keyserver also contains information such as the user IDs on the key (name/email/comment) and signatures on the key.
The size (in bits) of the private key is what provides your security factor. There's excellent material that describes equivalencies between asymmetric and symmetric key strengths , but in general, a 2048-bit RSA modulus is considered the current "standard", and you'll see keys up to 4096-bits RSA for people who want more of a security factor. Beyond 4096, it's very much diminishing returns, and users should consider transitioning to something like ECDSA (Elliptic Curve).
The security of an asymmetric cryptosystem such as RSA (which PGP uses) is not based directly on the length of the public or private key, but rather on the length of the relative prime numbers which are chosen in their construction.
The public and private keys are then derived from those two selected relative primes. The security of the algorithm depends on the difficulty associated with factoring large relative prime numbers without knowing some additional information.
Thus, the actual key strength of RSA is not the length of the public or private key, but rather the complexity in factoring the chosen prime values on which the keys are based.