Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

AES 256 is used widely in hybrid crypto systems (e.g. SSL/TLS). According to a 2048 bit public key corresponds to 112 bits of security.

  • Does it make sense to use AES 256 in this context?
  • If yes, how it improves security in comparison with AES 128?
share|improve this question
Something tells me this answer is able to answer big chunks of your question already. Also, the answers to this question seem to provide some good hints. – e-sushi May 2 '14 at 14:21

It's possible to use much larger key sizes than 2048 bit RSA for TLS. So the argument that 256 bit RSA provides much more security than 2048 bits RSA may not apply.

If used with a 2048 bit RSA key then using AES-256 may not make too much sense. But don't forget that AES-256 will be used to encrypt large amounts of plaintext, and that attacks on AES will be quite different from attacks on RSA. Furthermore, AES-256 is not that much slower than AES-128 - and certainly not twice as slow as you may expect.

In general using AES-128 or AES-256 won't make much of a difference. Using EDH for perfect forward secrecy or the application of strong(er) authentication will arguably have more of an impact on security.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.