Is there a comparison between 4096 Bit RSA-Key and a 2048 Bit RSA-Key? I'd like to know what impact on performance it has, if I'm choosing a 4096-Bit key for ssl-encryption. Is there any info which says, how much more CPU usage will be required if a 4096 bit key is used instead of a 2048 bit one?
-
Related question on the security stack: security.stackexchange.com/questions/65174/…– MrWhiteCommented Dec 28, 2016 at 11:09
-
"Is there a comparison between 4096 Bit RSA-Key and a 2048 Bit RSA-Key?" You can do as many as you want, with various results, all depending on your setup, and of course it will change from one day to the next (Moore's law and so on). More important, bigger isn't always better and take whatever government agency you prefer and you will have documents with guidances on which crypto systems to use or not depending on very careful studies and discussions (that you can decide to trust or not, of course). Anyway, nowadays elliptic cryptography is prefered mostly.– Patrick MevzekCommented Aug 15, 2022 at 14:17
Add a comment
|
3 Answers
Use OpenSSL's speed command to benchmark the two types and compare results. Here's an example command to run on the server to compare only the key types and sizes you mention:
openssl speed rsa2048 rsa4096
For reference, here are some benchmark results from a modest VPS:
sign verify sign/s verify/s
rsa 2048 bits 0.000685s 0.000032s 1459.1 31629.7
rsa 4096 bits 0.007574s 0.000113s 132.0 8851.0
As you can see, doubling the certificate key size places an enormous additional burden on the server's CPU and is many times slower. Avoid 4096 bit keys unless you have a specific threat model which requires their use.
I decided to run openssl speed with three key sizes: 1024, 2048 and 4096 bits. Here are the results on my home PC, which is decent but far from exceptional as far as number-crunching power goes:
sign verify sign/s verify/s
rsa 1024 bits 0.000273s 0.000017s 3662.2 59513.0
rsa 2048 bits 0.001994s 0.000052s 501.5 19254.5
rsa 4096 bits 0.014438s 0.000219s 69.3 4560.3
So by doubling the key length, the time to sign a message increases by 7x, and the time to verify a signature increases by more than 3x.
Either way you slice it, the performance impact of moving from 2048-bit RSA to 4096-bit RSA is highly significant.
It is also highly doubtful that you have a SSL workload which requires the additional security from 4096-bit RSA.
You would almost certainly do better by implementing forward secrecy instead, as doing so would reduce the impact of a key compromise at very little extra cost to either the server or the client.
Update from 2022:
Device for benchmark:
- MacBook Pro (16 Zoll, 2019)
- 2,6 GHz 6-Core Intel Core i7
- 16 GB 2667 MHz DDR4
openssl version:
LibreSSL 2.8.3
Running the same command as before ..
openssl speed rsa2048 rsa4096
.. leads to:
sign verify sign/s verify/s
rsa 2048 bits 0.000891s 0.000049s 1122.1 20270.8
rsa 4096 bits 0.006737s 0.000174s 148.4 5741.9
I know the numbers are barely camparable. Nevertheless we are searching for the factor the calculationtime jumps by switching from 2048 to 4096.
Hence, comparing the 'sing/s' of 2048 and 4096:
Year Person 2048 4096 CTR*
------------------------------------------------
2016 tom 1459.1 132.0 11.05
2016 user 501.5 69.3 7.2367
2022 me 1122.1 148.4 7.5613
------------------------------------------------
avg of 3 1027.57 116,57 8.8153
*CTR = Calculation Time Raise (2048/4096)
Doubling the bits of the RSA-key (2048 -> 4096 = Factor 2), the calculation time raises by more than a factor of 7
