I've been asked to generate a public key with PuTTY key generator. The default is 2048 bits, should I add additional bits to the generated key? Or is it unnecessary?

  • 1
    The general guideline (at the moment) is: stick with 1024 at a minimum, go with 2048 to be safe, use 4096 if you're paranoid (and/or a government), and use more if you want to show off. – KnightOfNi Jul 1 '14 at 23:00
  • 1
    What do you need to do with this key? – user1301428 Jul 2 '14 at 8:43
  • Lock down an HR / CRM system that will probably also be accessed for 3rd party queries. But it has HTTP Access too. – leeand00 Jul 2 '14 at 12:37
  • Sorry I meant https access. – leeand00 Jul 2 '14 at 12:46

1024 is considered the minimum key size for RSA at the current time. For general purposes i would say that 2048 is enough. However, if you will use this key to transfer highly sensible data (e.g. related to bank accounts or important server passwords etc..) I´d go with 4096 bits.


There seems to be a convention of using power of 2 keysizes, it's not strictly required but it seems to be the norm.

The best known way to attack RSA is to factor the modulus to get p and q, once p and q are known it's trivial to reconstruct the rest of the private key. How difficult that factorisation is depends on the size of the modulus.

512 has been factored by hobbyists.
768 bit has been factored by researchers in a public challange.
1024 can probablly be factored now by well-funded orgnisations but noone has publically admitted doing it.
2048 is generally thought to be secure for the time being.
4096 is what the more paranoid go for, especially for long lived keys.

Personally I use 4096 for all newly generated keys.


Depending on how paranoid you are and how secure the server needs to be, 2048 should be enough. It's going to take many years for someone to break that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.