What RSA key size to use for an SSL certificate | Hacker News Reader

What RSA key size to use for an SSL certificate

certsimple.com

35 pointsck218 comments

"NIST says a 2048 bit RSA key has a strength of 112 bits: i.e., there are theoretically 2^112 possibilities to brute force the private key."

This is incorrect. The number of 2048-bit RSA keys is much more than 2^112, bruteforcing is out of question. 2^112 is an approximate number of operations to compute the private key using techniques more efficient than brute force (e.g. number field sieve described later in the article).

Author here. That's correct, thanks for spotting the error: indeed, it means using a field sieve as mentioned in the article body, which is certainly not brute force. I've fixed the quote and credited you accordingly.

> The results show a 2048 bit RSA key is equivalent to around 116 'bits' of a symmetric algo. Actually, 116.884, but since, you can't have .884 of a bit our JS implementation rounds down.

The number of bits is just the log base 2 of some complexity measure. You can certainly have half of a bit in this context.

"4096 bit handshakes are indeed significantly slower in terms of CPU usage than 2048 bit handshakes."

I bet they are even slower on mobile devices.

Yep, and battery life too. I'll do a followup at some point with latency figures from remote devtools on an android device.

Is there a reason 3072-bit or 2560-bit RSA keys can't be used?

RSA doesn't restrict key sizes to powers of 2, but powers of 2 are more optimised for implementation.

http://crypto.stackexchange.com/questions/7849/why-are-rsa-k...

the answers you linked to cite key sizes of c * 2^k where c = 1,3,or 5 -- like 3072 = 3 * 1024, 2560 = 5 * 512.

The way forward will probably be to switch to ECDSA anyway, just like Cloudflare "Universal SSL".

Yeah (author here) I'd like to do a followup with ECC. There's a few cloud providers who only take RSA keys but ECC is otherwise fairly well supported these days.

I'll also amend the openssl / certreq commands CertSimple generate to provide an ECC option.

By the time time people switch to ECDSA, they should switch to Ed25519 or Ed448, maybe with ECDSA fallback (with web server and TLS library support for multiple keys for same domain, depending on ClientHello).

Have Ed25519 or Ed448 been standardized into TLS? I've never seen a website with that before.

They will be: https://tools.ietf.org/html/draft-ietf-tls-curve25519-01

So far, that's only key exchange, not signatures [1]. CFRG is still debating a signature method [2].

1 - https://tools.ietf.org/html/draft-irtf-cfrg-curves-07

2 - https://www.ietf.org/mail-archive/web/cfrg/current/msg07291....

Ah, true. Hopefully, they will use the same curves, with EdDSA.

http://www.wolframalpha.com/input/?i=N[Log2[Exp[%2864%2F9*Lo...]

That graph of "comparable algorithm strength" would be great if it included the key length of the symmetric cipher.

It was discussed for 2048 bit RSA, but not for 4k or 8k. It seemed like an oversight.

One could go for the middle ground with a 3072 bit key.

Reply on news.ycombinator.com