What RSA key size to use for an SSL certificate

https://certsimple.com/blog/measuring-ssl-rsa-keys

by ck2 • 11 years ago

35 18 11 years ago

certsimple.com

ck2• 11 years ago

"4096 bit handshakes are indeed significantly slower in terms of CPU usage than 2048 bit handshakes."

I bet they are even slower on mobile devices.

nailer3• 11 years ago

Yep, and battery life too. I'll do a followup at some point with latency figures from remote devtools on an android device.

giovannibajo1• 11 years ago

The way forward will probably be to switch to ECDSA anyway, just like Cloudflare "Universal SSL".

nailer3• 11 years ago

Yeah (author here) I'd like to do a followup with ECC. There's a few cloud providers who only take RSA keys but ECC is otherwise fairly well supported these days.

I'll also amend the openssl / certreq commands CertSimple generate to provide an ECC option.

wolf550e2• 11 years ago

By the time time people switch to ECDSA, they should switch to Ed25519 or Ed448, maybe with ECDSA fallback (with web server and TLS library support for multiple keys for same domain, depending on ClientHello).

rsy96• 11 years ago

Have Ed25519 or Ed448 been standardized into TLS? I've never seen a website with that before.

jjuhl• 11 years ago

One could go for the middle ground with a 3072 bit key.

dchest3• 11 years ago

"NIST says a 2048 bit RSA key has a strength of 112 bits: i.e., there are theoretically 2^112 possibilities to brute force the private key."

This is incorrect. The number of 2048-bit RSA keys is much more than 2^112, bruteforcing is out of question. 2^112 is an approximate number of operations to compute the private key using techniques more efficient than brute force (e.g. number field sieve described later in the article).

nailer3• 11 years ago

Author here. That's correct, thanks for spotting the error: indeed, it means using a field sieve as mentioned in the article body, which is certainly not brute force. I've fixed the quote and credited you accordingly.

jason_s2• 11 years ago

Is there a reason 3072-bit or 2560-bit RSA keys can't be used?

userbinator• 11 years ago

RSA doesn't restrict key sizes to powers of 2, but powers of 2 are more optimised for implementation.

http://crypto.stackexchange.com/questions/7849/why-are-rsa-k...

jason_s2• 11 years ago

the answers you linked to cite key sizes of c * 2^k where c = 1,3,or 5 -- like 3072 = 3 * 1024, 2560 = 5 * 512.

x13• 11 years ago

http://www.wolframalpha.com/input/?i=N[Log2[Exp[%2864%2F9*Lo...]

amluto• 11 years ago

The results show a 2048 bit RSA key is equivalent to around 116 'bits' of a symmetric algo. Actually, 116.884, but since, you can't have .884 of a bit our JS implementation rounds down.

The number of bits is just the log base 2 of some complexity measure. You can certainly have half of a bit in this context.

pronoiac• 11 years ago

That graph of "comparable algorithm strength" would be great if it included the key length of the symmetric cipher.

It was discussed for 2048 bit RSA, but not for 4k or 8k. It seemed like an oversight.

What RSA key size to use for an SSL certificate

Related Stories