In NIST FIPS 186-4, "digital signature algorithm", the minimal length allowed is 1024 bit (page 22). On the contrary, in NIST SP800-56B, page 63, RSA-OAEP encryption, the minimal length is 2048. Why 1024 is secure enough for digital signature but not for encryption?
$\begingroup$
$\endgroup$
1
-
2$\begingroup$ Depending on the use-case a signature key-pair only needs to be secure for a foreseeable amount of time (eg 2 years if no one wants to verify signatures after that point anymore like eg it happens in TLS) where an encryption keypair may need to protect data much longer, especially if copies of the public key and ciphertext have been made. $\endgroup$– SEJPMCommented Jun 18, 2018 at 20:09
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
Three reasons:
- Technical: often the integrity and origin of a piece of data becomes immaterial after the data is acted upon; and for long-term use (e.g. document signing), if the security of the signature becomes questionable, there is often the option to stop considering the key valid, and make a new signature with a larger key size, restoring security. When for encryption (one of the common goal of key establishment), we can't make the ciphertext disappear from the adversary's archive. Therefore, at any given time, we arguably need less security margin (smaller RSA modulus) for signature than for key establishment targeting long-term confidentiality.
- Scope: my reading of NIST's FIPS 186 standard is that it specifies modulus sizes mostly for interoperability purposes, with security level not in the core scope; when NIST SP 800-56B is a recommendation with security level in scope. At least, only the later includes comparison with symmetric cryptography key sizes.
- Historical: FIPS 186-4 (July 2013) is a standard with a long history, with RSA included in FIPS 186-1 (December 1998) which as RSA is concerned essentially approved a subset of ANS X9.31, with minimal key size set to 1024-bit for both; that size then made a lot of sense. When NIST SP 800-56Br1 is more recent (September 2014), revising earlier NIST SP 800-56B (August 2009) which still allowed 1024-bit RSA.
