# When was the RSA 64-bit key introduced into internet encryption?

When (if ever) was a key length of 64 bits used in "internet encryption" and when was that "cryptographic standard" first introduced?

Following up, when did "internet encryption" key lengths change to 128-bits, then to 256-bits, 512-bits and so on up to 2048-bits? Was the same "cryptographic standard" used?

• I don't think RSA with 64, 128, or 256 bits was likely ever used on the internet. It seems like you are mixing asymmetric and symmetric key sizes. – mikeazo Oct 29 '16 at 13:12
• Pretty sure this question meant "bytes" rather than "bits". – Nat Jul 12 '18 at 22:56
• The original RSA challenge of 1977, from which came my very own name, had a 270-bit modulus, already more than 32 bytes = 256 bits. – Squeamish Ossifrage Jul 14 '18 at 2:05
• WIKIPEDIA: RSA Numbers has a list of RSA Numbers from the RSA Factoring Challenge (as well as other good info on common RSA sizes) -- this may help clarify to others why asking about "RSA 64-bit" comes off as a confusing question, and help readers understand why some people will want to talk about RSA keys in terms of "digits" and not "bits". – Shaun Wilson Jul 14 '18 at 2:48

The RSA paper from 1977 recommends the following on page 9:

We recommend using 100-digit (decimal) prime numbers p and q, so that n has 200 digits.

200 digits is 663 bits, which would have been pretty strong in 1977. Due to the US government instituting export controls on cryptography in the early 1990s, 512 bit RSA became widely implemented as it was the maximum allowed for export. I can't find any examples of keys smaller than 512 bits being used in practice, other than in the RSA factoring challenge.

• In France, bank Smart Cards used 321-bit keys from approximately 1985 to 2001. See this for more. – fgrieu Jul 13 '18 at 19:25

DISCLAIMER: I am not a crypto-expert. This question has some ambiguity making it hard to answer well. This is an attempt to remove some ambiguity for anyone else with the same question by conveying relevant history of "cryptography and the internet" between the late 80s and early 2000s. I will highlight our use of non-RSA algorithms (which used a "64-bit key") and also how/when widespread use of RSA would have appeared.

When we say "internet encryption" does this imply SSL over HTTP, or, are we willing to include any "cryptographic standard" that was in practical use after "the internet was more widely used?"

In the latter case, let's accept The Year that September Never Ended to qualify 1993 as when "the internet was more widely used."

Further, let us accept that RSA (appears 1977) was not a widely used cipher until the advent of SSLv2 (appears 1995), primarily due to computational requirements and the adoption of symmetric ciphers as the typical alternative. When RSA would be considered widely used the typical key size of 512- to 1024-bits was considered nominally secure (versus computation power of the time) whereas today 1024- to 2048-bits is considered nominally secure. As noted by others, I don't believe you would have ever seen RSA in widespread use with a key size of 64-bits for "internet encryption", however, it could have been used at any point between 1977 to present to send data over the 'net enciphered with a 64-bit (or larger) key.

## Cryptographic Standards: DES (64-bit), AES (128- to 256-bit)

TL;DR: 64-bit ciphers were in widespread use for "internet encryption" up to and including the late 90s, but they were not RSA.

In 1977 the U.S. Government standardized upon FIPS-46, this was a cryptographic cipher using a 64-bit key (56-bits keyspace + 8-bits parity), and it is this cipher that would have been in widespread use for most "internet encryption" as it was computationally cheaper than RSA, with less overhead to accomplish the same tasks (like sending a continuous stream of data.) During this period if RSA was used it would typically be to exchange keys for a symmetrically-secured stream, a practice which continues to this day.

Despite its theoretical weaknesses at the time FIPS-46 was established and updated from 1977 forward. By 1993 it would have been at FIPS-46-2 (1988-2001). However, it was generally regarded as weak by the crypto community, and an ongoing effort to find a replacement gained significant momentum throughout the early 90s. As a result, by 1997 FIPS-46 was proven insecure and the U.S Government was finally on track to establish a new cryptographic standard.

Beyond the 1990s; FIPS-46 was reserved almost exclusively for government systems that were yet-to-be migrated over to the new standard known as FIPS-197 (2001), aka. AES (1998) aka. Rijndael (1997), which supported 128, 160, 192, 224 or 256-bit key sizes. There were of course spin-offs of DES which appeared in the late 90s and beyond but these are considered broken by way of MITM attacks.

TL;DR: SSLv2 makes RSA more commonplace for key exchange, however, non-RSA algorithms continue to be used as data ciphers as they are computationally cheaper.

A significant shift in personal computing occurred in 1994: the publication of the Secure Sockets Layer (SSL) which coincided with a rapid growth of world-wide-web users (initially, primarily, using Netscape Navigator or lynx.) When we say "SSL" we're talking about an internet protocol which applies multiple "ciphers"; one for key exchange AND and one additional for data ciphering. Typically key exchange is performed with an asymmetric algorithm (of which RSA is an option) and data ciphering is performed using a symmetric key (of which RSA is -not- an option.)

SSL does allow for the use of ciphers which support keys larger than 64-bits, but first, I want to point out that different people may talk about the "bits" of SSL from different frames of reference: the "key exchange algorithm" key length, the "cipher algorithm" key length, and the "cipher algorithm" block size. It used to be that the average person referred to the cipher algorithm block size when talking about the strength of SSL (ie. "128-bit SSL"), but today it seems people will reference the strength of the key exchange algorithm instead (ie. "2048-bit SSL") -- like when discussing the purchase of an SSL certificate. It can sometimes help to be clear about which algorithm/procedure within the SSL/TLS protocol is being referred to:

Cipher Algorithms
Key Exchange Algorithms
• RSA; appears in SSLv2 through TLSv1.2 allows for the use of RSA during key exchange, and of course this allowed for key lengths greater than 64bits. As others have noted the only limiting factor for its use were computational complexity and export controls (ITAR in the early 90s would have limited the application of the algorithm, but not availability, and so we would see certain public key types, such as cipher but not signature, limited to less-than 512-bits.)

By 2008 TLS1.2 would become a widely adopted, and with this "internet encryption" has had access to a 128-bit to 256-bit keyspace via AES.

## So.. What does it all mean?

It means 64-bit keys (non-RSA) would have been widely used for "internet encryption" from 1977 until the late 90s. After 1997 the adoption and use of keys larger than 64-bits would become commonplace and 128-bit or larger keys (non-RSA) would have been in use since at least 2001-2002 (with "early adoption" in the late 90s appearing in the form of SSL patches for Windows/IE and updated crypto libraries from the FOSS community.)

The late 90s saw a wider adoption of alternative "non-standard" algorithms (two-fish/blowfish, 3des, idea, etc); their adoption from 1999 through the 2000s grew exponentially as the number of internet users was growing exponentially and the subject of Information Security would finally become a top-priority for the wider internet community.

It's safe to say that RSA was not widely used for internet encryption until the mid 90s, and that it has since been employed with an average key length of 512- to 2048-bits for key exchange. What would have been widely used RSA key lengths from 1977 to 1989 is not well known, @jsfierro's link to 'The RSA Paper' is probably the best reference for this period, we can also look at RSA Numbers for solved and unsolved challenges and get a sense of what a nominally secure key length would have been over time -- with the earliest factorization listed as occurring in 1991.

### References

(in no particular order)

• SSL/TLS never used 2DES (nor did SSH, nor TTBOMK IPsec); 3DES is 112-bit instead of 168-bit because of MitM which to cryptographers is a 'break', but in practice 112-bit is still secure, and 3DES is only now being dropped gradually because of its data block size of 64 bits ('sweet32'). AES was published for TLS1.0 in 2002, and widely implemented well before 1.1 in 2006 and 1.2 in 2008, although notably not by WIndowsXP. ChaCha was published as a cipher in 2008, but not adopted for TLS (min 1.2) until 2016. ... – dave_thompson_085 Jul 13 '18 at 5:01
• ... ITAR in the early 1990s did restrict US export of RSA encryption over 512 bits, but allowed unlimited signature, which is why some 'export' suites in SSL3 and TLS1.0 have a nominally ephemeral RSA encryption key, limited to 512, in ServerKeyExchange, signed by the static key in the certificate; see rfc2246. These suites were dropped in TLS1.1 because by 2006 EAR had formally relaxed some restrictions and others weren't being enforced. – dave_thompson_085 Jul 13 '18 at 5:03