22

I've noticed that websites start to use 256-bit symmetric encryption, but often still end up using 2048-bit RSA keys.

http://www.keylength.com/en/3/

The link above displays the ECRYPT II recommendations, which state that 128-bit symmetric and 3248-bit asymmetric encryption have a compareable strength.

The NIST recommendations state that 128-bit symmetric is comparable to 3072-bit asymmetric encryption.

This would mean that 2048-bit RSA is weaker than 128-bit symmetric encryption. Which makes me wonder why websites are starting to offer 256-bit symmetric encryption while the weakest link (RSA) doesn't even offer 128-bit strength.

Is there anything I'm missing here?

Improve this question

4 Answers 4

Reset to default
30

People use 256-bit encryption because they can, and, given the choice, people tend to go for the biggest numbers, because they feel that they "deserve it".

Scientifically, it does not indeed make sense to use AES-256 when the key exchange relies on 2048-bit RSA. This is just wasted CPU cycles; AES-128 would have been equally fine. But "256" can woo auditors into submission. Such are the intricacies of the human psychology.

Improve this answer
5
  • 6
    There's also the argument that in the future someone might migrate to a higher bit strength of RSA keys, and that the configuration for the keys is decoupled from the configuration of allowed ciphers. This way the auditors can jerk off on segregation of privilege and limiting key access.
    – friedkiwi
    Jun 18, 2014 at 14:50
  • 1
    The rule is, more is always better, right? ;)
    – Alvar
    Jun 18, 2014 at 19:00
  • 3
    It could also potentially help if a significant weakness is discovered in the symmetric encryption method which nullifies some of the entropy, there have been many unknown weaknesses in encryption algorithms which have reduced the entropy significantly but have stayed unknown for many years. Having some excess can help with this.
    – Vality
    Jan 2, 2015 at 19:50
  • 3
    Belief that "key entropy" acts like some kind of sci-fi shield strength that is incrementally consumed by cryptanalytic attacks, is unsubstantiated. It is a common reflex to go for longer keys as if it granted some sort of "security margin", but in fact attacks don't work that way. In the case of AES and the only known non-trivial attacks (which are related-key attacks so not an immediate worry), 256-bit keys turn out to be weaker than 128-bit keys, not stronger. The only case where longer keys are actually "stronger" is against brute force, for which 128-bit keys are already strong enough.
    – Tom Leek
    Jan 7, 2015 at 14:51
  • 1
    @TomLeek I was under the impression that related-key attacks hit AES-256 harder than AES-128 (e.g., the relative decrease in security is larger for AES-256), but that AES-256 still has a higher margin of security in that event. From your statement, though, it appears my understanding is wrong. Can you explain a little further?
    – Stephen Touset
    Jan 15, 2017 at 23:59
14

The RSA weakness only applies to the key exchange and establishing the session. If the attacker doesn't catch this, the actual communication itself is far more resistant to brute force with the 256 bit symmetric encryption. (Though both are currently way, way beyond impossible to brute force. Key reduction attacks that could come up in the future could make it a significant difference, but that isn't known now.) The RSA is the weakpoint, but that doesn't mean that it isn't worth using higher security for the persistent portion of the connection/session.

Improve this answer
3
  • 6
    Claiming that AES-256 is "more secure" than AES-128 assumes that the latter is somehow weak in some way that the former is not. As far as we know, this is not true. There is no known practical weakness of AES-128 that AES-256 does not share. Moreover, there is not really good reason to believe that AES-256 would fare better than AES-128 against future cryptanalytic results; in fact, when talking about the academic weakness known as "related keys" (no practical consequence), it works in the opposite way, AES-128 being stronger than AES-256.
    – Thomas Pornin
    Jun 18, 2014 at 15:23
  • 1
    @ThomasPornin - fair point, I update to indicate that it is simply more resistant to brute force, though both are currently well in to not brute forceable territory. As I understand it, certain exotic attacks could reduce the bits substantially though (such as certain quantum attacks), but higher key length should reduce the impact of this type of attack (even if it make it slightly more vulnerable to others).
    – AJ Henderson
    Jun 18, 2014 at 15:27
  • This answer is much better than accepted one.
    – Victor Yarema
    Dec 21, 2018 at 11:27
1

When the cipher suite uses forward secrecy, the server certificate is only used for authentication, not encryption.

A 2048-bit RSA key may not seem to justify a 256-bit cipher but the ECDHE key exchange for forward secrecy results in much stronger encryption without using the CA signed cert.

Without forward secrecy or with DHE key exchange, maybe 256-bit ciphers do not make sense, but they do make sense with ECDHE.

Improve this answer
1
  • This does not answer the question. Of course AES-256 might be justified. But the question is only about AES-256 with RSA-2048.
    – A. Hersean
    Apr 6, 2017 at 12:31
0

The better question is why even use 2048 bit rsa and no 4096 bit rsa or one of the newer and better algorithms?

Besides even if aes256 is wasting cpu cycles (and I agree that it is), cpu cycles are plentiful, you should always use an encryption algorithm strength double of what is considered safe and with anything involving network transfers your connection is going to be the bigger bottleneck than aes128 vs aes256 especially on standard 100/100 mbit fth lines. Maybe one when 100/100 gbit lines are considered standard the difference will be more noticable but by then we will have much faster cpus too and the debate over aes128 vs aes256 will be the same as the debate of 8 vs 32GB ram today (aka 32GB being the bare minimum).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .