search

TechnitiumSoftware / Mesh

A secure, anonymous, peer-to-peer, instant messenger!
https://mesh.im
GNU General Public License v3.0
193 stars 58 forks source link

RSA Bit Size #2

Closed mva1985 closed 4 years ago

mva1985 commented 4 years ago

Thanks so much for the release of Mesh

This is not really an issue but would like to see minimum RSA set to 4096 or maybe even user select-able

I've seen some articles that the Feds are starting move to higher bit strengths for their encryption standards. They haven't eliminated 3072 bit strength but it appears they are moving in the direction of 4096

Anyone, please feel free to add my USER ID (d9acf0d1cd34855c2664dbcab1d971804bd855a3) if you'd like to experiment around with Mesh.im

ShreyasZare commented 4 years ago

Thanks for the post. RSA 2048 is safe to use as of now. Using higher RSA key size causes issue with some devices with less CPU power as it takes lot of time to generate it and to sign with it.

Another thing is that, the RSA key pair is only used to verify peer's identity. It is not used to perform any key exchange or encryption. The data is encrypted with AES 256 and the AES keys are exchanged using ECDHE 256 bit. This also provides you with forward secrecy.

In later versions, its planned to do away with RSA and use elliptic curve algorithms for the entire secure channel implementation.

mva1985 commented 4 years ago

that makes perfect sense... thanks for that