Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

My question is about the key length of a asymetric algorithm. How is it possible to memorize or remember a key that is about 4000 bits long?

share|improve this question
add comment

4 Answers 4

up vote 7 down vote accepted

How is it possible to memorize or remember a key that is about 4000 bits long?

One could reasonably ask the same question about AES: how is it possible to remember a key that is 128 bits long?

The answer is: "it doesn't really matter, because no one actually tries to remember a sequence of 128 random bits, much less 4000 bits anyways".

Instead, we have computers do the memorizing; after all, they're going to do the operations on the RSA key anyways (certainly no one is going to attempt an RSA operation on a 4kbit by hand), so we might as well get them to do the memorization piece as well.

share|improve this answer
    
that's what I thought, doing RSA by hand would be really difficult! Thank you! –  Sara Feb 28 at 4:57
    
4kbit RSA public key operation using small public exponent is feasible, even by hand. I strongly recommend using computer (or table/phone) for computationally heavier private key operation. –  user4982 Feb 28 at 18:17
add comment

A 4000-bit RSA key is reasonable (more precisely, that would be the bit size of the public modulus; and 4096-bit would be more common). But it is not reasonable to memorize it (or, more precisely, that the owner try to memorize the corresponding private key); and that's practically never done.

One does not ask normal users to memorize or remember a key, or other information, with more than perhaps 50 bits worth of entropy (say as 8 characters among 77, or 2 phones numbers); even that is hard, and XKCD's method is probably more reasonable.

Long asymmetric private keys are usually

  • Stored encrypted by way of a symmetric algorithm using a stretched password/phrase as key, and stored on disk as a file; that's what PGP, GPG, and many other programs do.
  • Not stored, but rather re-generated at each use, from a passphrase combined with stretching seeding a CSPRNG used by the key generator; advantage is that the passphrase entirely replaces the private key in normal usage; but that makes safe passphrase change impossible; and requires a lot of stretching and a long passphrase to be secure.
  • Stored (and while we are at it used) inside a Smart Card protected by PIN with error counter (locking the card after 3 consecutive errors).
share|improve this answer
add comment

By key I assume you mean a passphrase. 4000 bits is 500 letters, with an average letter count of 4.5 in an English word, that's 125 words. With 15-20 words per sentence that's anywhere from 5 to 8 paragraphs. A small poem.

Yes, it's practical.

An actual key (like the PGP key one would post on their website) is ideally random so you can't be expected to remember more than a few characters.

share|improve this answer
1  
Can't agree with " Yes, it's practical ". Do we live in a world with the same human capabilities? –  fgrieu Feb 28 at 6:46
1  
@fgrieu Well I didn't say it would be effortless. I surprised myself the other day by remembering entire song lyrics from years ago, and there are those who can quote entire bible passages. But as with all things human, your mileage may vary. –  rath Feb 28 at 7:26
4  
@rath I would rather say it is possible but not that it is practically done. Garry Kasparov might store his RSA keys that way ;) –  DrLecter Feb 28 at 7:59
add comment

Depends on your encryption method, but it is not unreasonable to have a key that is 4k bits. That being said, no one is expected to memorize that. Or even write it down. That should all be stored in memory.

share|improve this answer
    
that was my exact answer to the question because it made no logical sense for a human being to memorize it. –  Sara Feb 28 at 4:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.