# System encryption LUKS: What's the strongest and most secure key size?

I'm reading an article on the Arch Linux wiki about system encryption, in an example the author specified a 512 bit key. From what I read on Wikipedia regarding encryption ciphers it doesn't seem to be secure enough. That leads me to the question: what's the strongest possible key size?

-
See also: rubber-hose cryptanalysis (obligatory xkcd) – grawity Apr 17 '11 at 14:02

I don't have enough reputation to comment on the above answers concerning RSA, but they're both wrong in the context of the question asked, so for all people who happen to read this question in the future:

LUKS uses symmetric ciphers (encryption and decryption use the same key). RSA is an asymmetric cryptosystem, which uses a key to encrypt and another to decrypt. To make this possible, it uses a neat piece of mathematics. Its security is based on the difficulty of factoring large numbers. This is why the key size for RSA must be thousands of bits (otherwise the numbers involved are not large enough and can be factored in acceptable time given an attacker with enough resources).

Symmetric cryptosystems like LUKS do not need the same large key sizes because the keys are not tied to a number that can be factored to break the encryption. Therefore they are considered safe with much lower key sizes. Currently 128 bits are considered safe. AES, the standard algorithm for symmetric crypto, also supports 256 bits in case you're paranoid.

It would take 2n tries to exhaustively search the keyspace of a symmetric cipher, where n is the length of the key in bits.

To give you an idea of the scales involved: If you had 10 million computers who could each test 10 million keys per second, it would still take several thousand times the current age of the universe to search all of the keys for a key size of 128 bits.

This means you're safe from a brute-force attack, no matter who the attacker is. Brute-forcing a symmetric key is not the way to go. Even attacking weaknesses in the cipher is difficult when you use high-quality ciphers like AES, etc, although the NSA might have some insights that the rest of the world doesn't have. But frankly it is way easier to hit you over the head with a large stick until you give up the passphrase.

-
Good point, many people are confused about the difference between symmetric and asymmetric. And good job with this first post! – Kevin Panko Oct 23 '13 at 17:56

There isn't any strongest possible key.

For each key of length n you can always add one bit to make it stronger.

-
And ultimately the weakest link will almost always be the passphrase chosen. – Cry Havok Apr 17 '11 at 10:42
@Peter - You can also use TrueCrypt for a 3-striped encryption if you are that paranoid. (But yes, the key is THE most important part.) – Shiki Apr 17 '11 at 10:47
@Nifle Then, what's the most preferable key size? – Peter Apr 17 '11 at 10:47
@Shiki - I've been thinking of using TrueCrypt, however it seems more suitable to use LUKS for Arch Linux. It also seem more easy to map partitions and have them mounted in the proper order. But if TrueCrypt is preferable, I'll check it out again. Thanks. – Peter Apr 17 '11 at 10:51
@Peter - The maximum allowed? :) (Just don't forget it.. lol) – Shiki Apr 17 '11 at 10:52

RSA itself contains weaknesses, as see RSA Algorithm section "Weaknesses in RSA", as well as Cracking RSA and RSA: Hacking and Cracking.

That said, and if the method being used to crack your encryption is only brute force, then the strongest possible key size is the one that will require more computing power than is available to the hacker that is trying to decrypt your messages, or more time than he is willing to spend.

Recently, a 200-long RSA key was factored in 50 years of computer time, and 307-long in 100 years of computer time. I suppose even 128-bit will still take a few years of computer time.

1024 bits might be proof against most crime-rings, but so are probably 512-bits and even 128-bit. 1024 bits is surer, but do you expect an agency with the computing-power of the US National Security Agency to be used against you ?

If all you are trying to protect yourself against is the neighborhood script-kiddo, then 128 bits are enough. If you are trying to protect your bank transactions, then no hacker wastes his time trying to decrypt RSA, but rather will try to trick you into installing his trojan.

-

I personally use a 2048-bit key, and find that my CPU can keep up with the maximum bandwidth of my SATA drive with no problems. I'd recommend a 2048 on any modern hardware (1GHz or faster processor).

-

The RSA recommends:

RSA Laboratories currently recommends key sizes of 1024 bits for corporate use and 2048 bits for extremely valuable keys like the root key pair used by a certifying authority

http://www.rsa.com/rsalabs/node.asp?id=2218

so I would go for at least 1024 bits.

Note that the bigger the key size, the slower the encryption/decryption will be.

-
Then what's the most preferable cipher? The example I mentioned before in the Arch Wiki uses aes-xts-plain. Would that be a good choice along with either a 1024 or 2048 bit sized key? Thanks. – Peter Apr 17 '11 at 11:24
If you have a nice powerful machine (anything modern should do fine) then go for 2048. If your machine is a little older (say a P3) then don't go above 1024 bit. – Majenko Apr 17 '11 at 11:43