Americas

  • United States

Asia

Oceania

roger_grimes
Columnist

Calculate necessary crypto key length

Analysis
May 29, 20072 mins
Data and Information SecuritySecurity

Someone at Microsoft just turned me on to this cool site. www.keylength.com The site lists various standards and their recommended crypto sizes. You can click on any listed crypto algorithm and see how long a crypto key of that size should remain relatively protective. It's all generic and doesn't include a large number of external factors that would impact the key's overall useful life, but it is a starting poi

Someone at Microsoft just turned me on to this cool site.

www.keylength.com

The site lists various standards and their recommended crypto sizes. You can click on any listed crypto algorithm and see how long a crypto key of that size should remain relatively protective. It’s all generic and doesn’t include a large number of external factors that would impact the key’s overall useful life, but it is a starting point for reference.

I frequently have customers and readers ask me how long their key size should be for a particular application. It’s like asking what car someone should buy? There’s a lot of factors involved, with no single answer. In order to determine how long a particular cypto key should be you need to ask yourself many other questions first, including:

What is the value of the information you are protecting?

What is the security maturity of the company expecting the protection?

What is the likelihood of a sustained, multi-machine crack attack?

What are the regulatory requirements?

How often are the keys changed?

What cipher is used?

Crypto ciphers are just one mechanism to prevent a confidentiality leak. What other protections do you use? How is the information protected from physical attack?

Is the cipher algorithm protection mechanism implemented in hardware or software?

And so on.

roger_grimes
Columnist

Roger A. Grimes is a contributing editor. Roger holds more than 40 computer certifications and has authored ten books on computer security. He has been fighting malware and malicious hackers since 1987, beginning with disassembling early DOS viruses. He specializes in protecting host computers from hackers and malware, and consults to companies from the Fortune 100 to small businesses. A frequent industry speaker and educator, Roger currently works for KnowBe4 as the Data-Driven Defense Evangelist and is the author of Cryptography Apocalypse.

More from this author