0

It's always been told that ECDSA is more secure "per bit of key size", such that it offers same security with a shorter key, or offers stronger security with the same key length.

However, per my understanding, if the length of the key is fixed, it means that the amount of entropy is also fixed (e.g. 160-bit ECDSA key contains no more entropy than 2^160, and a 192-bit AES key contains no more entropy than 2^192). So why is ECDSA considered "more secure" at the same level of entropy?

iBug
  • 1,378
  • 1
  • 10
  • 12
  • 5
    Possible duplicate of [Is it bad that my ed25519 key is so short compared to a RSA key?](https://security.stackexchange.com/questions/101044/is-it-bad-that-my-ed25519-key-is-so-short-compared-to-a-rsa-key). In short: the complexity of the problem to solve does not solely depend on the key length but also on the algorithm. And neither RSA nor ECC keys are random, so looking entropy simply as a function of the key length is not meaningful here. – Steffen Ullrich May 10 '19 at 17:07
  • 1
    i would rather store an 8 char password with bcrypt than a 10 char password with MD5... – dandavis May 10 '19 at 18:23

1 Answers1

0

ECDSA is an asymmetric digital signature algorithm based on Elliptic Curve Cryptography (ECC), closer in purpose and function to digital signatures using RSA. Both are asymmetric algorithms that are very different than AES, which is a symmetric encryption algorithm.

The comparison you are talking about is most likely comparing ECC key sizes to RSA key sizes. This is where the math differs. ECC’s strength is based on the difficulty of solving the discrete logarithm problem.

RSA's strength is based on the difficulty of factoring the product of two very large prime numbers.

The comparison of the two must take into account the difficulty of the math, not of the simple count of the bits.

AES, being symmetric, is completely different. A brute force attack on AES simply consists of trying every possible key in the 2^128 space.

For more information on key lengths, check out https://www.keylength.com, which has an interesting set of comparisons of key lengths taking into account historic, modern, and predicted futures.

John Deters
  • 33,897
  • 3
  • 58
  • 112
  • 1
    The attacks on Factoring RSA modulus is not trying different primes. See this [paper](https://www.iacr.org/archive/eurocrypt2000/1807/18070001-new.pdf) about factoring 512-bit modulus. For EC, the geometrical interpretation forms an abelian group and for that reason, we use point addition and scalar multiplication. The discrete log problem is the key to the ECDSA attacks. – kelalaka May 11 '19 at 00:04