Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [key-size]

Key size is the size measured in bits of the key used in a cryptographic algorithm.

96
votes
7answers
56k views

How big an RSA key is considered secure today?

I think 1024 bit RSA keys were considered secure ~5 years ago, but I assume that's not true anymore. Can 2048 or 4096 keys still be relied upon, or have we gained too much computing power in the ...
69
votes
4answers
63k views

What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?

AES has several different variants: AES-128 AES-192 AES-256 But why would someone prefer use one over another?
36
votes
4answers
17k views

Security strength of RSA in relation with the modulus size

NIST SP 800-57 §5.6.1 p.62–64 specifies a correspondence between RSA modulus size $n$ and expected security strength $s$ in bits: ...
23
votes
3answers
8k views

Is 80 bits of key size considered safe against brute force attacks?

I came across the KATAN family of ciphers for small domain input blocks. They cipher arbitrary block lengths: 32, 48 and 64, but their key size is 80 bits only. Is 80 bits of key size considered ...
3
votes
2answers
961 views

Mathematical formula for switching the key for OTP?

Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? The new key must be as random and ...
12
votes
3answers
5k views

AES Key Length vs Block Length

This answer points out that certain key and block lengths were a requirement for the AES submissions: The candidate algorithm shall be capable of supporting key-block combinations with sizes of 128-...
7
votes
1answer
2k views

Why can ECC key sizes be smaller than RSA keys for similar security?

I understand how ECC is based on the discrete log problem and RSA on integer factorization. I've read several references that show how a solution to either of these problems can typically be adapted ...
12
votes
2answers
3k views

How much can we compress RSA public keys?

I am wondering to what degree we can define an RSA variant, with a security argument that it is as safe as regular RSA with a given modulus size $m$ (e.g. $m=2048$), in which the public key has a ...
11
votes
3answers
9k views

What should be the size of a Diffie-Hellman private key?

I'm implementing the SRP-6 protocol, which relies on discrete logarithms for it's security (essentially Diffie-Hellman). The RFC documents state: The private values $a$ and $b$ SHOULD be at least ...
9
votes
1answer
1k views

How were the AES key and block length subsets of Rijndael selected?

My intuition tells me it's a trade off between speed and security, but how did the standardisation process select these three seemingly arbitrary key lengths (namely, AES-128, AES-192, AES-256).
9
votes
2answers
8k views

How many keys does the Playfair Cipher have?

I was just studying the Playfair cipher and from what I've understood, it is just a slightly better version of a Caesar cipher, in that it isn't actually mono-alphabetic but rather the 'digrams' are ...
16
votes
4answers
4k views

Why are RSA key sizes almost always a power of two?

I know that other bit sizes are possible, e.g. this HTTPS server seems to have a 9000 bit key https://www.ssllabs.com/ssltest/analyze.html?d=qqq.gg, but it's very rare that one sees a key not of size ...
6
votes
2answers
3k views

Is RSA key size the size of private key exponent?

I have implemented a key pair generation scheme for RSA algorithm. I have taken the length of private key exponent as RSA key size, but then I've got to know that RSA key size is the size of the ...
6
votes
1answer
4k views

What is the maximum size of the plaintext message for RSA OAEP?

OAEP is an important technique used to strengthen RSA. However, using OAEP (or any technique that adds randomness) reduces the size of plaintexts that can be encrypted. Assume for instance that OAEP ...
12
votes
1answer
8k views

What size should the HMAC key be with SHA-256?

I'm trying to generate a secret key to be used for HMAC SHA-256 signature processing. I've seen many sample of keys with variable length from 32 characters to 96 characters. What is the ironclad rule ...
3
votes
4answers
6k views

Is 512-bit RSA still safe for signature generation?

The standard CSP on Windows XP only supports RSA up to 512-bit, which means that it's the maximum key size I can use for authenticity verification of updates. The public key is embedded in the updater,...
12
votes
2answers
6k views

Argon2 output length and parameter storage?

I just started using the libsodium port for .net today and the output length parameter kind of confused me (I'm using the argon2i implementation). With my limited exposure to hashing, whatever hash ...
4
votes
1answer
761 views

what are the NTRU keysize and application in industry?

I'm a student currently working on a research project on the NTRU cryptosystem, I've read some papers about this cryptosystem, and in those papers they are talking about keysize, is it the size of the ...
1
vote
1answer
366 views

Choosing primes in the Paillier cryptosystem

In the first step of key generation phase in Paillier cryptosystem given here. It's given that $$\operatorname{length}(p) = \operatorname{length}(q) ) \implies \operatorname{gcd}(pq,(p-1)(q-1))=1$$ ...
15
votes
3answers
6k views

Why does the recommended key size between symmetric and asymmetric encryption differ greatly?

In various articles it is mentioned that for secure communications, the recommended key sizes are 128-bit key size for symmetric encryption (which makes it $2^{128}$ possible keys?) and 2048-bit key ...
8
votes
2answers
2k views

Why is the complexity of RSA-1024 80 bit and not 86 bit?

Why is the complexity of RSA-1024 80 bit and not 86.76611925028119 bit? Here is the complexity for the GNFS (pulled from the linked Wikipedia article): $$\exp\left( \left(\sqrt[3]{\frac{64}{...
2
votes
1answer
3k views

AES key/ciphertext space sizes

This is giving me a brain ache now... If I have AES-128, block is 128 bit, then every plaintext (128-bit) can be encrypted to some ciphertext that is also 128-bit. This is the block size. But: 128-bit ...
24
votes
1answer
16k views

How strong is the ECDSA algorithm?

Some cryptographic algorithms are as strong as the size of their key is, while other have some weaknesses that limit their strength (such as SHA-1). How strong is the ECDSA algorithm, and does that ...
14
votes
2answers
2k views

How do I get the equivalent strength of an ECC key?

I know how to calculate the comparable symmetric strength of an RSA modulus: calculate the running time for a field sieve. This is how NIST gives approximate symmetric sizes for asymmetric algos in ...
10
votes
2answers
635 views

Key Size for Symmetric Homomorphic Encryption Over the Integers

In the paper Fully Homomorphic Encryption over the Integers, it mentions a symmetric key scheme on page 1 and 2. Key Generation: Pick a random odd number $p \epsilon [2^{N-1},2^N)$ Encrypt A Bit m: $...
6
votes
3answers
10k views

Export from US of crypto software with key-size > 56 bits still needs permission?

Elsewhere someone stated that he couldn't publish his crypto software on the Internet, because US Export Regulations require approval, if the key size is greater than 56 bits. I know that several ...
5
votes
1answer
707 views

Can there be a need for 1024-bit (symmetric) encryption?

I think we are all aware of the CAESAR-competition. Now the aim of this competition is to select a (portfolio of) winner(s) which provide authenticated encryption. I'll now assume that the results ...
2
votes
1answer
819 views

Padding for the TEA

Sorry if this is a noob questions, but I finally figured out how to implement the Tiny Encryption Algorithm in C++. My question is what to do about padding the key and the plaintext? I know that ...
2
votes
1answer
410 views

Requirement for the length of a HMAC tag?

I've seen NIST requirements about key length. What about the output lengths ? Is 112 bits enough for the HMAC output length ? Can we truncate the tag to keep only 112 bits ?
2
votes
4answers
1k views

Does it make sense to have a 4000 bit long key?

My question is about the key length of a asymetric algorithm. How is it possible to memorize or remember a key that is about 4000 bits long?
1
vote
1answer
316 views

Equal length of primes in paillier cryptosystem

In the key generation step of paillier cryptosystem , In order to satisfy $\gcd(pq,(p-1)(q-1))=1$ , we can take equal length primes. Instead of taking(length as parameter to generate $p,q$) equal ...
0
votes
2answers
207 views

How to calculate the key size of my cryptographic system

I have a 'for fun' project, which is a pure software based redesign of the Enigma I. I'd like to compute the key length of my design, but I need some help with that. I have a write-up here (see ...
0
votes
1answer
1k views

Probability of guessing random 128-bit AES key

Consider the following five events: Correctly guessing a random 128-bit AES key on the first try Winning a lottery with 1 million contestants Winning a lottery with 1 million contestants 5 times in a ...
6
votes
1answer
189 views

Digital signature for an expiring password

I would like to create a publicly available tool that is used to generate a password that gives a limited time access to a resource. My idea is to digitally sign the current date with a private key ...
4
votes
2answers
405 views

For RSA keys, is the safety of a given key-length different for signing vs encryption?

I'm wondering if considerations of key-length are different when thinking about signing vs encryption. If for some reason, it was safter to use smaller keys for signing that would be interesting.
4
votes
1answer
3k views

ECC vs RSA: how to compare key sizes?

I know and I have understood the details of RSA, elliptic curve cryptography, (EC)DH and (EC)DSA. I keep reading everywhere that (if we don't consider non-deterministic computers) "ECC can achieve ...
2
votes
4answers
6k views

Finding length of a key for a given vigenere cipher using Index of Coincidence

I'm developing an algorithm that takes in a vigenere cipher and produces the key length automatically. However, I'm having trouble understanding how to detect the key length when there are multiple ...
1
vote
1answer
419 views

For RSA, is there a specified size range for $p$ and $q$ when calculating $N$?

Is there a specified size range for $p$ and $q$ when calculating $N$? For example, what size would $p$ and $q$ be when $N$ is 1024 bits?
0
votes
2answers
123 views

Is there a way of increasing the time to brute force a cipher, but by increasing the ciphertext size instead of the key size?

If you have a symmetric-key algorithm that is limited to using a small key size (say 40-bits) is there any way you could increase the resistance to brute force attacks without increasing the key size? ...
0
votes
1answer
2k views

Why exactly Blowfish max key length is 448

Could anyone, please, tell me history of birth of Blowfish algorithm? Specifically, what is substantiation of Blowfish key length to be in range from 32 till 448 bits? Why, for example, it wasn't 64-...