information security technical report 15 (2010) 21e27 available at www.sciencedirect.com www.compseconline.com/publications/prodinf.htm Choosing key sizes for cryptography Alexander W. Dent Information Security Group, University Of London, Royal Holloway, UK abstract After making the decision to use public-key cryptography, an organisation still has to make many important decisions before a practical system can be implemented. One of the more difficult challenges is to decide the length of the keys which are to be used within the system: longer keys provide more security but mean that the cryptographic operation will take more time to complete. The most common solution is to take advice from information security standards. This article will investigate the methodology that is used produce these standards and their meaning for an organisation who wishes to implement public-key cryptography. ª 2010 Elsevier Ltd. All rights reserved. 1. Introduction being compromised by an attacker). It also typically means a slower scheme. Most symmetric cryptographic schemes do The power of public-key cryptography is undeniable. It is not allow the use of keys of different lengths. If a designer astounding in its simplicity and its ability to provide solutions wishes to offer a symmetric scheme which provides different to many seemingly insurmountable organisational problems. security levels depending on the key size, then the designer However, the use of public-key cryptography in practice is has to construct distinct variants of a central design which rarely as simple as the concept first appears. First one has to make use of different pre-specified key lengths. (In other choose the type of public-key cryptography that is appropriate words, while AES-128 and AES-256 are based on the same to solve the organisational problem in question. The array of principles, they have different internal components which choice is bewildering: public-key encryption schemes, digital have been chosen to complement the different key lengths). In signature schemes, signcryption schemes, identification particular, the allowable key lengths are chosen by the schemes, attestation schemes, and any number of more spe- scheme designer. Public-key schemes are different e they cialised schemes with different functional properties and typically have one design which can be used with keys of any security guarantees. length (without further input from the scheme designer). After which the organisation has to develop an infra- Hence, it is up to the user, rather than the designer, to deter- structure to generate and distribute authentic copies of the mine an appropriate key length for use with the scheme. public and private keys. The problems with developing an This often leaves a complicated mathematical decision appropriate public-key infrastructure (PKI) have been widely in the hands of a mathematically inexperienced security documented. Even the importance of, and problems with, manager. The most common mechanism for determining an generating random keys have been widely discussed in both appropriate key length is to consult a standard. There are the practical and theoretical literature. One aspect of key several standards which give key length recommendations for generation has been largely ignored in the practical literature: common public-key technologies (e.g., NIST, 2007; ECRYPT-II, the problem of choosing appropriate key lengths. 2010). To aid security managers in making sensible decisions, In a well-designed cryptographic scheme, a longer key these standards typically give key lengths in terms of the means higher security (and a reduced chance of the system amount of time that the key will “work” e i.e., the amount of E-mail address: [email protected]. 1363-4127/$ e see front matter ª 2010 Elsevier Ltd. All rights reserved. doi:10.1016/j.istr.2010.10.006 22 information security technical report 15 (2010) 21e27 time that data secured by a key of this length can be consid- Table 1 e ECRYPT-II key size recommendations (ECRYPT- ered secure. The mathematical source of the numbers in these II, 2010). standards, and their practical meaning, is often misunder- Equivalent Validity RSA- Discrete- Elliptic- stood. This article will investigate the methodologies which symmetric based log-based curve-based produce these standards and attempt to give some intuition as key size modulus Key Group key size to whether the advice they provide is suitable for a particular size size size cryptographic scheme. 80 Up to 2014 1248 160 1248 160 112 Up to 2020 2423 224 2423 224 128 Up to 2040 3248 256 3248 256 2. Key-length standards 160 e 5312 320 5312 320 192 e 7936 384 7936 384 For the purposes of this article we will differentiate between 256 Foreseeable 15424 512 15424 512 future a cryptographic primitive and a cryptographic scheme. A cryptographic scheme is a set of practical algorithms that can be used within an organisation to solve some security problem. A cryptographic primitive is a basic piece of mathematics on which cryptography can be based, but which is not suitable for It is also important to understand the source of these use as a cryptographic scheme on its own. For example, the numbers. For certain symmetric key schemes, it is possible to RSA transform (Rivest et al., 1978) is a primitive, as it can be prove that no attacker can break the scheme, regardless of the used to build cryptographic scheme but is generally not amount of time or computational resources they apply to the considered practical for use as a cryptographic scheme on its problem, e.g., Shannon’s one-time pad encryption scheme own. There are a bewildering array of different public-key (Shannon, 1949). This can never be the case for public-key schemes, but the vast majority of practical schemes are based cryptography: given a public key, and sufficient time, an on a few basic primitives: attacker can always deduce the corresponding private key and thus break the scheme. The best we could ever hope to ach- RSA- or factoring-based. For example, RSA-OAEP encryption, ieve is to show that an attacker is unlikely to break the scheme RSA-KEM encryption, HIME(R) encryption, RSA full domain in a given period of time. However, even with this more hash signatures, RSA-PSS signatures, Rabin signatures, etc. modest goal, the mathematics is unfavourable. A proof that Discrete-logarithm-based. For example, DHIES encryption, there exists no strategy which would break a public-key PSEC encryption, DSA signatures, ElGamal signatures, scheme with any reasonable probability would answer e Schnorr signatures, HMQV key agreement, etc. a famous open problem in theoretical computer science the s e 2 Elliptic-curve-based. For example, ECIES encryption, PSEC NP P conjecture for which the Clay Mathematics Institute encryption, ECDSA signatures, etc. have offered a $1M prize. So, if there exists no mathematical way to bound the Therefore, the first step in determining secure parameters probability that an attacker can break a scheme within for a cryptographic scheme is to determine secure parameters a certain time, how do the standards generate reliable reco- for the underlying primitive. This is a highly technical math- mmendations for key sizes? Not all standards bodies chose to ematical task and there are a number of important research release their methodologies for assessing key-length security; papers which attempt to answer this question (Blaze et al., however, the publicly-known methodologies seem very 1996; Lenstra and Verheul, 2001; Lenstra, 2004). The conclu- similar (Lenstra and Verheul, 2001; Lenstra, 2004; ECRYPT-II, sions of these research papers have been presented as guid- 2010). The key principle is that, since we cannot mathemati- ance to the security community in the form of international cally prove a bound on the probability of an algorithm breaking standards or recommendations (e.g., NIST, 2007; ECRYPT-II, a scheme, we rely on the opinion of skilled mathematicians 2010). These standards typically recommend key sizes by who understand the algorithms that may be used to break the comparing them to symmetric keys with equivalent security underlying mathematical primitives, assessed through a three and/or by giving an estimate for the length of time that the key stage process. will keep data secure. We give a some examples of the key size In the first stage, the mathematicians attempt to find recommendations1 in Tables 1 and 2. a relationship between the time it would take the best-known It is important to understand the meaning of the validity algorithms to break a random example of the underlying period. The validity period tells you how long data that has primitive and the time it would take an algorithm to break been protected with a key of a certain length can be consid- a symmetric key scheme through exhaustive search using ered secure e i.e., after the expiry date, data secured by a key technology available at a particular point in time. For can no longer be considered secure. It is not meant to serve as example, in the case of breaking the RSA primitive, we a guide for when a key should replaced or updated. There are examine the best-known algorithms for inverting a randomly- good reasons to change keys before the expiry date, for chosen ciphertext produced by encrypting a randomly-chosen example because it reduces the impact of key exposure. The message using a randomly-chosen RSA public key. The best- use of long keys should not be thought of as a substitute for known algorithm to break the RSA primitive involves good key management and key lifecycle practices. factoring the RSA modulus. We know from historical data that 1 See also http://www.keylength.com/. 2 http://www.claymath.org/millennium/. information security technical report 15 (2010) 21e27 23 Lastly, the researchers decide what is an acceptable length of Table 2 e NIST key size recommendations (NIST, 2007).