Hacker News Reader

Comment by cesarb | Hacker News Reader

There must be something I'm missing here. As far as I know, the state of the art is to use 256 bits for encryption keys, both for symmetric (AES-256, Chacha20) and asymmetric (Curve25519, the 256-bit NIST curves), and they are considered both fast and safe. Are they trying to ban some kind of post-quantum cryptography which uses larger keys?

View on HN

Curve448 also exists, which uses ~448-bit keys. Although with that, it only offers 224 bits of security (Compared to Curve25519's 128). And NIST-P521 exists, with similar properties. I wonder whether this legislation strictly applies to the bits-of-security, or bits-of-key-length.

IIUC, AES-256 will be fine for the forseeable future, even with quantum computers. However, Curve25519 could fall relatively soon, depending on how rapidly quantum computing advances.

For TLS much larger keys are typically used, "The recommended minimum key length is 1024 bits, with 2048 bits preferred, but this is up to a thousand times more computationally intensive than symmetric keys of equivalent strength (e.g. a 2048-bit asymmetric key is approximately equivalent to a 112-bit symmetric key) and makes asymmetric encryption too slow for many purposes."

Source: https://www.internetsociety.org/deploy360/tls/basics/

This is wrong at least as a response to the original comment, which is correct about the state of the art (TLS is also moving to elliptic curves where shorter keys are used).

For signatures, I hope EdDSA wins out over ECDSA.

TLS isn't encrypting data with those longer keys. That's used for auth and connection bring up before switching to a symmetric encryption scheme to actually encrypt data.

Reply on news.ycombinator.com