1

Say I have a page on my website which lists public keys to be used in case people would either allow me access to a server, or send me encrypted information.

Is there any benefit to me providing different types of keys for users to use, or multiple keys of the same type but different sizes?

For example, a page on my website that looks like this (with links to the full keys, not just the fingerprints):

RSA v1: 20:ad:11:7f:f1:39:8a:e8:58:3f:a0:62:d8:98:cf:2f
DSA: 93:c2:ad:b7:cd:15:1f:ee:50:7b:c1:a0:13:79:a2:e7
ECDSA: 3b:83:67:dd:c7:66:07:05:a7:39:41:a8:90:76:c4:d7
RSA v2 (2048 bits): 54:4f:6d:a1:22:ec:84:24:2f:aa:99:e1:66:cb:b5:29
RSA v2 (4096 bits): 11:98:59:14:d1:42:20:68:97:29:9d:b3:fd:5e:6f:f9

IQAndreas
  • 6,557
  • 8
  • 32
  • 51

1 Answers1

3

  • Since encryption and signatures are distinct operations, it makes sense to have distinct keys. This really boils down to the need for distinct lifecycle management characteristics (backup or not backup, that is the question).

  • Supporting several types of keys theoretically allows for better interoperability: clients who know only RSA use the RSA key, while clients who don't support RSA can use ECDSA. (This is only theoretical, because in practice everybody supports RSA.)

  • Having several types of keys can potentially ease things if a catastrophic breakthrough occurs: if some half-mad mathematician comes up with, say, a very efficient factorization algorithm, RSA is toast, so being able to switch to something based on elliptic curves would be required. Having prepared the terrain with already deployed keys and implementations will make the transition smoother. People often talk of this as "biodiversity of algorithm", even though algorithms are not living entities, thus not relevant to biology.

  • In the case of RSA-2048 vs RSA-4096, my guess is that the key owner was just overenthusiastic. It makes little sense to go to 4096 bits, since 2048 bits are more than enough to defeat known and foreseeable cracking technology. It makes no sense at all to have both keys active at the same time. However, some people really love big numbers.

Community
  • 1
Thomas Pornin
  • 320,799
  • 57
  • 780
  • 949