1
$\begingroup$

I am in the process of created a signing certificate and i have an option of RSA-4096 or RSA-3072. Is there much difference in security between the two? I know people say RSA-3072 should be good until 2030. But people may also prefer the high security. But if it makes a big difference on speed, they may not. So do you think it is worth using RSA-4096 for the next 10 years?

$\endgroup$
3
  • 1
    $\begingroup$ see www.keylength.com $\endgroup$
    – kelalaka
    May 26 at 6:45
  • $\begingroup$ The biggest difference in speed you will see for the RSA key generation. For security, see kelalaka's link. $\endgroup$
    – j.p.
    May 27 at 6:25
  • $\begingroup$ Formally, FIPS 186-4 does not support 4096-bit: "This Standard specifies three choices for the length of the modulus (i.e., nlen): 1024, 2048 and 3072 bits". And that might be a problem in some contexts. I have yet to meet any regulatory reason to exceed 3072-bit, and I seldom see a technical reason to do so (an exception would be something that needs to remain secure for many decades and a lot of care is used to make the data still exploitable at that time). But I sometime use 4096-bit as a paranoia damper. $\endgroup$
    – fgrieu
    Jun 25 at 13:20
0
$\begingroup$

See here, they mention that there is not particularly good software support for RSA-3072.

$\endgroup$
1
  • 1
    $\begingroup$ That answer is from a long time ago, I'd take it with a grain of salt. The 3K response is certainly not correct these days, e.g. both OpenSSL and BouncyCastle support that and I've got FIPS validated modules for that. $\endgroup$ May 26 at 13:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.