A site supports Public key length of 256 bits while best practice is 1024+ - what does this mean?
Given that this is asymmetric cryptography with private/public key, I am not sure if reduced bit length is breakable easier than longer keys. I understand that the key population is reduced (hence randomness, hence brute force) however, I am still wondering, does this mean it is easily breakable? Are there any studies/research/cryptanalysis performed to measure what this mean?
The site I am referring to here is web.Whatsapp.com
India wants social media sites such as Whatsapp to make the content accessible by Government (because of hatred spread on social media that led to people being lynched!). Is it possible that the public key size is purposefully reduced to accommodate this?
I got a VPN through US and verified it is 256 bits for accessing in US too. So, is it possible that WhatsApp is not as secure as we think?
encryption cryptography whatsapp
edited 2 hours ago
schroeder♦
73.3k29160195
asked 5 hours ago
tazz
61
New contributor
tazz is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Given that this is asymmetric cryptography with private/public key, I am not sure if reduced bit length is breakable easier than longer keys. I understand that the key population is reduced (hence randomness, hence brute force) however, I am still wondering, does this mean it is easily breakable? Are there any studies/research/cryptanalysis performed to measure what this mean?
The site I am referring to here is web.Whatsapp.com
India wants social media sites such as Whatsapp to make the content accessible by Government (because of hatred spread on social media that led to people being lynched!). Is it possible that the public key size is purposefully reduced to accommodate this?
I got a VPN through US and verified it is 256 bits for accessing in US too. So, is it possible that WhatsApp is not as secure as we think?
encryption cryptography whatsapp
edited 2 hours ago
schroeder♦
73.3k29160195
asked 5 hours ago
tazz
61
New contributor
tazz is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
The public key crypto being used by WhatsApp web is Curve25519.
– defalt
4 hours ago
Generally, to get 128 bit security for ECC, you need approximately double the key size, or 256 bits for the public key. To get the same for non-ECC asymmetric cryptography such as RSA, you need around 3072 bits. You really can't compare them. Also, if WhatsApp uses Curve25519, then it is sufficiently secure and has approximately 116 bits of effective security (i.e. equivalent to a 116-bit symmetric key).
– forest
2 hours ago
add a comment |
Given that this is asymmetric cryptography with private/public key, I am not sure if reduced bit length is breakable easier than longer keys. I understand that the key population is reduced (hence randomness, hence brute force) however, I am still wondering, does this mean it is easily breakable? Are there any studies/research/cryptanalysis performed to measure what this mean?
The site I am referring to here is web.Whatsapp.com
India wants social media sites such as Whatsapp to make the content accessible by Government (because of hatred spread on social media that led to people being lynched!). Is it possible that the public key size is purposefully reduced to accommodate this?
I got a VPN through US and verified it is 256 bits for accessing in US too. So, is it possible that WhatsApp is not as secure as we think?
encryption cryptography whatsapp
edited 2 hours ago
schroeder♦
73.3k29160195
asked 5 hours ago
tazz
61
New contributor
tazz is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Given that this is asymmetric cryptography with private/public key, I am not sure if reduced bit length is breakable easier than longer keys. I understand that the key population is reduced (hence randomness, hence brute force) however, I am still wondering, does this mean it is easily breakable? Are there any studies/research/cryptanalysis performed to measure what this mean?
The site I am referring to here is web.Whatsapp.com
India wants social media sites such as Whatsapp to make the content accessible by Government (because of hatred spread on social media that led to people being lynched!). Is it possible that the public key size is purposefully reduced to accommodate this?
I got a VPN through US and verified it is 256 bits for accessing in US too. So, is it possible that WhatsApp is not as secure as we think?
encryption cryptography whatsapp
encryption cryptography whatsapp
edited 2 hours ago
schroeder♦
73.3k29160195
asked 5 hours ago
tazz
61
New contributor
tazz is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 2 hours ago
schroeder♦
73.3k29160195
asked 5 hours ago
tazz
61
New contributor
tazz is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited 2 hours ago
schroeder♦
73.3k29160195
edited 2 hours ago
schroeder♦
73.3k29160195
edited 2 hours ago
schroeder♦
73.3k29160195
73.3k29160195
asked 5 hours ago
tazz
61
New contributor
tazz is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 5 hours ago
tazz
61
asked 5 hours ago
tazz
61
61
New contributor
tazz is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
tazz is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
tazz is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
1
The public key crypto being used by WhatsApp web is Curve25519.
– defalt
4 hours ago
Generally, to get 128 bit security for ECC, you need approximately double the key size, or 256 bits for the public key. To get the same for non-ECC asymmetric cryptography such as RSA, you need around 3072 bits. You really can't compare them. Also, if WhatsApp uses Curve25519, then it is sufficiently secure and has approximately 116 bits of effective security (i.e. equivalent to a 116-bit symmetric key).
– forest
2 hours ago
add a comment |
1
The public key crypto being used by WhatsApp web is Curve25519.
– defalt
4 hours ago
Generally, to get 128 bit security for ECC, you need approximately double the key size, or 256 bits for the public key. To get the same for non-ECC asymmetric cryptography such as RSA, you need around 3072 bits. You really can't compare them. Also, if WhatsApp uses Curve25519, then it is sufficiently secure and has approximately 116 bits of effective security (i.e. equivalent to a 116-bit symmetric key).
– forest
2 hours ago
1
1
The public key crypto being used by WhatsApp web is Curve25519.
– defalt
4 hours ago
The public key crypto being used by WhatsApp web is Curve25519.
– defalt
4 hours ago
Generally, to get 128 bit security for ECC, you need approximately double the key size, or 256 bits for the public key. To get the same for non-ECC asymmetric cryptography such as RSA, you need around 3072 bits. You really can't compare them. Also, if WhatsApp uses Curve25519, then it is sufficiently secure and has approximately 116 bits of effective security (i.e. equivalent to a 116-bit symmetric key).
– forest
2 hours ago
Generally, to get 128 bit security for ECC, you need approximately double the key size, or 256 bits for the public key. To get the same for non-ECC asymmetric cryptography such as RSA, you need around 3072 bits. You really can't compare them. Also, if WhatsApp uses Curve25519, then it is sufficiently secure and has approximately 116 bits of effective security (i.e. equivalent to a 116-bit symmetric key).
– forest
2 hours ago
add a comment |
2 Answers
2
active
oldest
votes
It's an up-to-date website using elliptic curve cryptography (ECC). ECC key sizes are not directly comparable with RSA, and a 256-bit key is more than enough for security -- 112-bit is the most that has ever been cracked. It's equivalent to a 3072-bit RSA key.
answered 4 hours ago
Mike Scott
7,6061930
add a comment |
In short, 256-bit public key is from ECC, i.e. elliptic curve cryptography.
The 1024-bit public key refers to bit length of RSA parameter $N$.
Now we are at late 2018, the best practice of RSA parameter $N$ is 2048-bit.
You can check https://en.wikipedia.org/wiki/Key_size for a detailed explanation regarding to key size.
answered 3 hours ago
9f241e21
573
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "162"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
tazz is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f200560%2fa-site-supports-public-key-length-of-256-bits-while-best-practice-is-1024-wha%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
It's an up-to-date website using elliptic curve cryptography (ECC). ECC key sizes are not directly comparable with RSA, and a 256-bit key is more than enough for security -- 112-bit is the most that has ever been cracked. It's equivalent to a 3072-bit RSA key.
answered 4 hours ago
Mike Scott
7,6061930
add a comment |
It's an up-to-date website using elliptic curve cryptography (ECC). ECC key sizes are not directly comparable with RSA, and a 256-bit key is more than enough for security -- 112-bit is the most that has ever been cracked. It's equivalent to a 3072-bit RSA key.
answered 4 hours ago
Mike Scott
7,6061930
add a comment |
It's an up-to-date website using elliptic curve cryptography (ECC). ECC key sizes are not directly comparable with RSA, and a 256-bit key is more than enough for security -- 112-bit is the most that has ever been cracked. It's equivalent to a 3072-bit RSA key.
answered 4 hours ago
Mike Scott
7,6061930
It's an up-to-date website using elliptic curve cryptography (ECC). ECC key sizes are not directly comparable with RSA, and a 256-bit key is more than enough for security -- 112-bit is the most that has ever been cracked. It's equivalent to a 3072-bit RSA key.
answered 4 hours ago
Mike Scott
7,6061930
answered 4 hours ago
Mike Scott
7,6061930
answered 4 hours ago
Mike Scott
7,6061930
answered 4 hours ago
Mike Scott
7,6061930
7,6061930
add a comment |
add a comment |
In short, 256-bit public key is from ECC, i.e. elliptic curve cryptography.
The 1024-bit public key refers to bit length of RSA parameter $N$.
Now we are at late 2018, the best practice of RSA parameter $N$ is 2048-bit.
You can check https://en.wikipedia.org/wiki/Key_size for a detailed explanation regarding to key size.
answered 3 hours ago
9f241e21
573
add a comment |
In short, 256-bit public key is from ECC, i.e. elliptic curve cryptography.
The 1024-bit public key refers to bit length of RSA parameter $N$.
Now we are at late 2018, the best practice of RSA parameter $N$ is 2048-bit.
You can check https://en.wikipedia.org/wiki/Key_size for a detailed explanation regarding to key size.
answered 3 hours ago
9f241e21
573
add a comment |
In short, 256-bit public key is from ECC, i.e. elliptic curve cryptography.
The 1024-bit public key refers to bit length of RSA parameter $N$.
Now we are at late 2018, the best practice of RSA parameter $N$ is 2048-bit.
You can check https://en.wikipedia.org/wiki/Key_size for a detailed explanation regarding to key size.
answered 3 hours ago
9f241e21
573
In short, 256-bit public key is from ECC, i.e. elliptic curve cryptography.
The 1024-bit public key refers to bit length of RSA parameter $N$.
Now we are at late 2018, the best practice of RSA parameter $N$ is 2048-bit.
You can check https://en.wikipedia.org/wiki/Key_size for a detailed explanation regarding to key size.
answered 3 hours ago
9f241e21
573
answered 3 hours ago
9f241e21
573
answered 3 hours ago
9f241e21
573
answered 3 hours ago
9f241e21
573
573
add a comment |
add a comment |
tazz is a new contributor. Be nice, and check out our Code of Conduct.
tazz is a new contributor. Be nice, and check out our Code of Conduct.
tazz is a new contributor. Be nice, and check out our Code of Conduct.
tazz is a new contributor. Be nice, and check out our Code of Conduct.
Thanks for contributing an answer to Information Security Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f200560%2fa-site-supports-public-key-length-of-256-bits-while-best-practice-is-1024-wha%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
The public key crypto being used by WhatsApp web is Curve25519.
– defalt
4 hours ago
Generally, to get 128 bit security for ECC, you need approximately double the key size, or 256 bits for the public key. To get the same for non-ECC asymmetric cryptography such as RSA, you need around 3072 bits. You really can't compare them. Also, if WhatsApp uses Curve25519, then it is sufficiently secure and has approximately 116 bits of effective security (i.e. equivalent to a 116-bit symmetric key).
– forest
2 hours ago