# Security of ciphersuite and key

Is anyone able to cite resources that can be based on choosing a cipher suite?

In my case, for a VPN server (OpenVPN) I chose a set of ciphers:

• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

It provides 128 bits of security. I have a dilemma regarding the length of the RSA private key. The 2048-bit key provides 112 security bits. If it is necessary to provide 128 bits, I would have to create a key with a length of 3072 bits - but this will have a significant effect on performance. If anyone could be able to direct me how to choose the right solution so that I could reasonably justify the choice would be great.

• Do you really need to use TLS 1.2? Why don't you use TLS 1.3 cipher suites? – kelalaka Jul 18 '19 at 22:04
• Most (all?) browsers still default to TLS 1.2 so supporting TLS 1.2 ciphersuites seems totally reasonable. – puzzlepalace Jul 18 '19 at 23:34
• Due to Bleichenbacher's attack, you should not use RSA at all if you have the choice. – tylo Jul 19 '19 at 10:22

However there's little reason to use RSA these days. Elliptic curve cryptography has generally better performance for the same security. Your default choice should be TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (or AES_256 instead of AES_128, or SHA384 instead of SHA256, or CCM instead of GCM), sticking to widely-supported ciphersuites. EdDSA and ChaCha20_Poly1305 are also good choices if supported. RSA as used in TLS_(EC)DHE_RSA_xxx ciphersuites has better performance than elliptic curve methods on the client side (at the cost of worse server-side performance) if you're only authenticating the server, which is often the case on the web. But if the two sides authenticate each other, as is normally the case on a VPN, elliptic curves have better performance.