# Is there a public key encryption scheme with optimal key size?

Symmetric encryption schemes such as AES have known security levels equal to their key sizes (i.e. breaking an encryption with an $n$ bit key needs about $2^n$ work steps). Elliptic curve encryption gets halfway towards optimal: its security is half the size of the public key.

Are there any public key encryption schemes known which have security level equal to size of public key? If not, do any do better than ECC?

• @rath I do see how it reflects the body. Any encryption scheme can not have a strength higher than the key size, thus the maximum possibly strength is the key size. This means that the optimal key size for encryption with a certain amount of bits of strength is that amount of bits of key. – orlp Aug 24 '13 at 8:49
• It should be clarified how "key size" is defined in the context of Public Key encryption. I think the interesting metric is the bit size of the most compact representation known for the public key (if that was private key bit size: it is trivial to turn a PK encryption scheme into a scheme with security $O(2^k)$ for a private key of $k$ bit: use that key to seed a PRNG, define the private key operation as including derivation of the original system's private key). – fgrieu Aug 24 '13 at 10:01
• @fgrieu that does not help much, does it? I mean, you can create a key pair that way, but then you would have created symmetric encryption as there is no way to create a public key without knowing the seed. – Maarten Bodewes Aug 24 '13 at 11:27
• @owlstead: Absolutly. That's why (compact representation of) the public key is the appropriate metric. – fgrieu Aug 24 '13 at 12:58
• @fgrieu I edited the question to make clear that this is about public key size, – Paŭlo Ebermann Aug 25 '13 at 12:23

For any cryptosystem based on finite cyclic groups, no, since the baby-step-giant-step algorithm has a complexity of O(sqrt(n)) and works for any finite cyclic group

• That explains why the discrete logarithm problem in a finite cyclic group has an asymptotic security / public key size ratio of at most $1/2$, when the PK is $g^x$ for some random $x$. It can't be generalized to any cryptosystem in such group. I am not sure for any public key cryptosystem in such group: why would not it be possible to devise such cryptosystem where the public key has some representation in $0.9\cdot\log_2(n)$ bits? Just like we have RSA variants with public key about $\log_2(n)/2$ bits with (near demonstrably) no loss of security, perhaps even $\log_2(n)/3$ bits. – fgrieu Aug 26 '13 at 18:59

I am skeptical that there will ever be a public key system that has the property you are seeking. Of course it would be possible to wrap a public key system up inside a symmetrical system to get that effect. For example, I could use 4096 bit RSA key which I protect with a 56 bit DES key, thus giving the system the strength of that, weaker, 56 bit symmetrical key. But leaving such things aside, I think that public keys will always be "special" in that their size in bits is not a direct representation of their strength in bits.

## Short statement of why I'm skeptical

Not just any number can be a secret key. So even if the worst case for the attacker who has to just randomly guess at candidate secret keys, they can rule out a large number of things before they have to start guessing.

## Symmetrical strength.

To understand why I'm skeptical, it is important to understand why strength == keysize works for symmetrical systems. Only then can we look at what is different about public key systems.

Alice picks, completely at random, a 128-bit key, k for AES. If AES isn't broken, Oscar's best hope is to simply guess k. (Actually, Oscar's best hope is to not attack Alice's key at all and instead try to get the message before it's encrypted or after it is decrypted or something else altogether.) If Alice used a cryptographically appropriate random number generator to pick k then k will be any one of 2^128 numbers, each with equal probability.

### Brute forcing symmetric keys

We are assuming through all of this (and this is a very fair assumption) that Oscar has a way of testing a key that will tell him whether or not he has the right one. In order to be sure of finding Alice's key, k, Oscar would need to make at most 2^128 guesses. On average, he only needs to check about half of those, so it is 2^127 guesses.

This works out that way because any candidate guess is as like (well, actually unlikely) to be the right one as any other. There is nothing to prefer certain guesses to others.

There is also no way (if everything else is designed properly) to get any information about k from looking at the encrypted traffic. There also should be no way to get any information about the key even if you know what some encrypted messages decrypt to. And finally (and this has been a really hot topic in practical cryptographic implementations), there should be no way to get any information about the key even if Oscar can get Alice to decrypt messages that he creates. In sort, a properly designed symmetrical system reveals absolutely no information about the key other than the fact that it is, say a 128 bits long.

So that has all been a long winded way of driving home the point that Oscar's best attack is to just guess at keys and any 128-bit number is as likely as another other.

## Public keys

Public keys are nothing like symmetrical keys. We've got the public key, p and the secret key, s. Alice picks a secret key, s, and calculates p based on s. She then publishes p. It is crucial that p is calculated from s. For these systems to work, there has to be a special mathematical relationship between p and s. For RSA s can be a pair of really big prime numbers and p can be something like the product of those two primes. (For the rest of this discussion I'm going to pretend that p is the product of the two primes, that this isn't quite how RSA really works.)

As you probably know, Alice can solve problems using s that cannot be done with knowledge of p alone, but p can be used to create such problems and p can be used to verify that the problems have been successfully solved.

The strength of the system depends on (among other things) that it be hard to compute s from p.

### Brute forcing private key

The analogy, I suppose, of a brute force attack on an RSA public modulus (to discover the primes) would be to take primes at random that are about the appropriate size (so half as many bits as p) and see if they divide p evenly. So here you see that a brute force attack involves far far fewer guesses than the size of p. If p is 2048 bit number, then the factors of p will each be around 1024 bit numbers.

Furthermore, not every 1024 bit number is prime; only about 1 in 300 of them are prime. (I'll say 1 out of every 256 so make rounding easier in my next step.) So for a brute force attack on a 2048 bit public key, Oscar "only" has to make 2^1016 guesses.

Now that is an awful lot of guesses, and would be more than sufficient. If this were the best way to discover s, then you would only need RSA keys about about 280 bits to get 128 bit security. But of course, this is an incredibly stupid way of attacking RSA.

However, there are two points from that simple example.

1. The secret key is (often) much smaller than the public key.
2. Not any number can be the secret key.

Either one of these mean that in terms of just blind guessing (brute force) the number of guesses necessary will be substantially shorter than the actual size of the public key.

### Don't brute force

There are ways to try to go from p to s that are better than just doing that kind of random guessing. In the case of RSA, there are much better ways. In terms of the discrete logarithm problem in integer fields (for Diffie-Hellmen public key stuff), there are much better ways than brute force guessing to discover the private keys as well. Indeed, if the private key isn't chosen with considerable care there are enormous shortcuts that Oscar can take.

## The best we can hope for

The best we can hope for is where guessing is the best strategy, but it will still be guessing in a limited domain. It won't be every possible number the size of the public key. Even though ECC and DH are based on the discrete logarithm problem (DLP), they are the DLP in different fields, and ECC is holding up remarkably well.

I don't know if we have theorems that prove that ECC will continue to hold up. It isn't perfectly at this "best case", but so far it seems to be close to that.

## Resources

I really recommend the book Understanding Cryptography by Christof Paar and Jan Pelzl. Chapters 8 and 9 do an outstanding job of explaining ECC and the kinds of attacks that might exist against it. The book is written well enough that it can genuinely be used for self study.

• I do not see an answer to the (very interesting and hard) question, nor an inventory of the (compressed) public key size vs security level for various known public key encryption (or signature) schemes. Also there is no discussion on why the private key can be reduced to the point of defining the security level, while the public key can't. I find the ECC chapter in "Understanding Cryptography" a fair introduction to ECC cryptography, but it is not explaining enough for my taste. – fgrieu Aug 26 '13 at 7:51
• I have other serious reservations on Understanding Cryptography beyond its ECC chapter. It is often imprecise, like it defines cryptography as "the science of secret writing with the goal of hiding the meaning of a message", leaving no room where message integrity fits in the picture of cryptology drawn in the intro; and it fails to mention countless security-critical facts, like in the section on CBC-MAC that this MAC is unsafe when the message size is allowed to vary. – fgrieu Aug 26 '13 at 8:34
• Fair points, @fgrieu. "Understanding Cryptography" does not teach about the security notions (e.g., PTXT-IND, CTXT-MAL, etc) needed to understand a lot of the crypto literature. But I found it an excellent introduction to the algorithms and to the basic protocols. – Jeffrey Goldberg Aug 26 '13 at 16:21

"Key size" or "number of bits" isn't the best way to measure security. Those are intermediate numbers. The true question at the heart of the matter is "how long can I expect method X to keep my secrets safe?" From there, we walk backwards to determine what adjustments or parameters we can change while using that particular method, we look at what attackers are capable of today, how attacks have changed so far since the discovery of the method, and estimate what the attackers might be capable of throughout the future. Each of those security methods is unique. Determining the useful life of any of these algorithms involves a lot of predicting the future, and is by no means a linear curve.

Current estimates of determining algorithm strength have come by comparing attack efforts. An experimenter determines the amount of computational work required to break x-bit RSA, and the amount of work required to brute force 56-bit DES. If it takes $10^{70}$ (a made-up-for-this-example number) CPU clock cycles to crack both DES and 512-bit RSA, then they could claim 512-bit RSA offers the equivalent to 56 bit security (they aren't, this is just a made-up example.)

But that's only one test at one point in time. Tomorrow, advances in differential cryptography could reduce the attack on DES from $2^{56}$ effort to $2^{40}$ effort. Or a novel advance in factoring could reduce the attack on RSA from $2^{56}$ to $2^{30}$. A quantum computer with Shor's algorithm could even reduce RSA to a solvable problem. We simply don't know what the future holds for any algorithm.

So as far as "optimal key size" goes, don't aim for "number of bits". Aim instead for "I need 30 years of protection, what might give that to me today?"

In public-key encryption, the public key can be seen as description of an instance of a mathematical problem that we assume to be intractable plus some additional information in most cases. The secret key is something that allows a user to solve this very instance of the problem efficiently. So, the public key size solely depends on the information needed to describe the problem. It is obvious that the best security we can hope to achieve depends on the entropy of the secret key, as this determines the complexity of a generic brute-force attack.

I am not aware of any results like for a certain hardness of a problem, the description has to be bigger than $x$. However, you might find some results in this direction in literature on complexity theory. So far, for all schemes I know the description of a problem instance is much bigger than the hint that allows to solve it, i.e. the secret key.