Weak Encryption: Insufficient Key Size

An otherwise strong encryption algorithm is vulnerable to brute-force attack when an insufficient key size is used.

Current cryptography guidelines suggest that a key length of at least 2048 bits should be used with the RSA algorithm. However, continued advancements in computing power and factoring techniques [1] mean that future increases in the recommended key size are inevitable.

Example 1: The following code uses the RSA algorithm with a 512-bit encryption key.

  static public byte[] EncryptWithRSA(byte[] plaintext, RSAParameters key) {
    try {
      RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(512);
      rsa.ImportParameters(key);
      return rsa.Encrypt(plaintext, true);
    }
    catch(CryptographicException e) {
      Console.WriteLine(e.Message);
      return null;
    }
  }

When it comes to symmetric encryption, the key lengths should be at least 128 bits.

An otherwise strong encryption algorithm is vulnerable to brute-force attack when an insufficient key size is used.

Current cryptography guidelines suggest that a key length of at least 2048 bits should be used with the RSA algorithm. However, continued advancements in computing power and factoring techniques [1] mean that future increases in the recommended key size are inevitable.

Example 1: The following code generates a 512-bit RSA encryption key.

  EVP_PKEY * get_RSA_key() {
    unsigned long err;
    EVP_PKEY * pkey;
    RSA * rsa;
    rsa = RSA_generate_key(512, 35, NULL, NULL);
    if (rsa == NULL) {
      err = ERR_get_error();
      printf("Error = %s\n",ERR_reason_error_string(err));
      return NULL;
    }
    pkey = EVP_PKEY_new();
    EVP_PKEY_assign_RSA(pkey, rsa);
    return pkey;
  }

When it comes to symmetric encryption, the key lengths should be at least 128 bits.

An otherwise strong encryption algorithm is vulnerable to brute-force attack when an insufficient key size is used.

Current cryptography guidelines suggest that a key length of at least 2048 bits should be used with the RSA algorithm. For symmetric encryption, key lengths should be at least 128 bits. However, continued advancements in computing power and factoring techniques [1] mean that future increases in the recommended key size are inevitable.

Example 1: The following code generates a 1024-bit RSA key:

  ...
  myPrivateKey := rsa.GenerateKey(rand.Reader, 1024);
  ...

An otherwise strong encryption algorithm is vulnerable to brute-force attack when an insufficient key size is used.

Current cryptography guidelines suggest that a key length of at least 2048 bits should be used with the RSA algorithm. However, continued advancements in computing power and factoring techniques [1] mean that future increases in the recommended key size are inevitable.

Example 1: The following code generates a 512-bit RSA key.

  ...
  crmfObject = crypto.generateCRMFRequest(
                "CN=" + name.value,
                password.value,
                authenticator,
        	keyTransportCert,
                "setCRMFRequest();",
                512, null, "rsa-dual-use");
  ...

When it comes to symmetric encryption, the key lengths should be at least 128 bits.

An otherwise strong encryption algorithm is vulnerable to brute-force attack when an insufficient key size is used.

Current cryptography guidelines suggest that a key length of at least 2048 bits should be used with the RSA algorithm. However, continued advancements in computing power and factoring techniques [1] mean that future increases in the recommended key size are inevitable. When it comes to symmetric encryption, the key lengths should be at least 128 bits.

Example 1: The following code utilizes a weak encryption algorithm and insufficient key size.

...
CCCrypt(kCCEncrypt,
        kCCAlgorithmDES,
        kCCOptionPKCS7Padding,
        key,
        kCCKeySizeDES, // 64-bit key size
        iv,
        plaintext,
        sizeof(plaintext),
        ciphertext,
        sizeof(ciphertext),
        &numBytesEncrypted);
...

An otherwise strong encryption algorithm is vulnerable to brute-force attack when an insufficient key size is used.

Current cryptography guidelines suggest that a key length of at least 2048 bits should be used with the RSA algorithm. However, continued advancements in computing power and factoring techniques [1] mean that future increases in the recommended key size are inevitable.

Example 1: The following code generates a 1024-bit RSA encryption key.

...
$keysize = 1024;
$options = array('private_key_bits' => $keysize, 'private_key_type' => OPENSSL_KEYTYPE_RSA);
$res = openssl_pkey_new($options);
...

When it comes to symmetric encryption, the key lengths should be at least 168 bits for Triple DES and 128 bits for AES.

An otherwise strong encryption algorithm is vulnerable to brute-force attack when an insufficient key size is used.

Current cryptography guidelines suggest that a key length of at least 2048 bits should be used with the RSA algorithm. However, continued advancements in computing power and factoring techniques [1] mean that future increases in the recommended key size are inevitable.

Example 1: The following code generates a 1024-bit RSA encryption key.

...
from Crypto.PublicKey import RSA
key = RSA.generate(1024)
...

When it comes to symmetric encryption, the key lengths should be at least 168 bits for Triple DES and 128 bits for AES.

An otherwise strong encryption algorithm is vulnerable to brute-force attack when an insufficient key size is used.

Current cryptography guidelines suggest that a key length of at least 2048 bits should be used with the RSA algorithm. However, continued advancements in computing power and factoring techniques [1] mean that future increases in the recommended key size are inevitable.

Example 1: The following code generates a 1024-bit RSA encryption key.

  require 'openssl'
  ...
  pkey = OpenSSL::PKey::RSA.new 1024
  ...
  

When it comes to symmetric encryption, the key lengths should be at least 128 bits for AES.

An otherwise strong encryption algorithm is vulnerable to brute-force attack when an insufficient key size is used.

Current cryptography guidelines suggest that a key length of at least 2048 bits should be used with the RSA algorithm. However, continued advancements in computing power and factoring techniques [1] mean that future increases in the recommended key size are inevitable. When it comes to symmetric encryption, the key lengths should be at least 128 bits.

Example 1: The following code utilizes a weak encryption algorithm and insufficient key size.

...
let iv = getTrueRandomIV()
...
let cStatus = CCCrypt(UInt32(kCCEncrypt),
UInt32(kCCAlgorithmDES),
UInt32(kCCOptionPKCS7Padding),
key,
UInt32(kCCKeySizeDES), // 64-bit key size
iv, 
plaintext, 
plaintextLength,
ciphertext, 
ciphertextLength,
&numBytesEncrypted)
...

An otherwise strong encryption algorithm is vulnerable to brute-force attack when an insufficient key size is used.

Current cryptography guidelines suggest that a key length of at least 2048 bits should be used with the RSA algorithm. However, continued advancements in computing power and factoring techniques [1] mean that future increases in the recommended key size are inevitable.

When it comes to symmetric encryption, the key lengths should be at least 128 bits.