Problem - Kevin Tafuro

Solution
There’s some debate on this issue. When using RSA, we recommend a 2,048-bit
instantiation for general-purpose use. Certainly don’t use fewer than 1,024 bits, and
use that few only if you’re not worried about long-term security from attackers with
big budgets. For Diffie-Hellman and DSA, 1,024 bits should be sufficient. Elliptic
curve systems can use far fewer bits.
Discussion
The commonly discussed “bit size” of an algorithm should be an indication of the
algorithm’s strength, but it measures different things for different algorithms. For
example, with RSA, the bit size really refers to the bit length of a public value that is
a part of the public key. It just so happens that the combined bit length of the two
secret primes tends to be about the same size. With Diffie-Hellman, the bit length
refers to a public value, as it does with DSA. * In elliptic curve cryptosystems, bit
length does roughly map to key size, but there’s a lot you need to understand to give
an accurate depiction of exactly what is being measured (and it’s not worth understanding
for the sake of this discussion—“key size” will do!).
Obviously, we can’t always compare numbers directly, even across public key algorithms,
never mind trying to make a direct comparison to symmetric algorithms. A
256-bit AES key probably offers more security than you’ll ever need, whereas the
strength of a 256-bit key in a public key cryptosystem can be incredibly weak (as
with vanilla RSA) or quite strong (as is believed to be the case for standard elliptic
variants of RSA). Nonetheless, relative strengths in the public key world tend to be
about equal for all elliptic algorithms and for all nonelliptic algorithms. That is, if
you were to talk about “1,024-bit RSA” and “1,024-bit Diffie-Hellman,” you’d be
talking about two things that are believed to be about as strong as each other.
In addition, in the block cipher world, there’s an assumption that the highly favored
ciphers do their job well enough that the best practical attack won’t be much better
than brute force. Such an assumption seems quite reasonable because recent ciphers
such as AES were developed to resist all known attacks. It’s been quite a long time
since cryptographers have found a new methodology for attacking block ciphers that
turns into a practical attack when applied to a well-regarded algorithm with 128-bit
key sizes or greater. While there are certainly no proofs, cryptographers tend to be
very comfortable with the security of 128-bit AES for the long term, even if quantum
computing becomes a reality.
* With DSA, there is another parameter that’s important to the security of the algorithm, which few people
ever mention, let alone understand (though the second parameter tends not to be a worry in practice). See
any good cryptography book, such as Applied Cryptography, or the Handbook of Applied Cryptography, for
more information.
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Selecting Public Key Sizes | 313