Why use 256-bit symmetric encryption in TLS when 2048-bit RSA doesn't even offer 128-bit strength?

People use 256-bit encryption because they can, and, given the choice, people tend to go for the biggest numbers, because they feel that they "deserve it".

Scientifically, it does not indeed make sense to use AES-256 when the key exchange relies on 2048-bit RSA. This is just wasted CPU cycles; AES-128 would have been equally fine. But "256" can woo auditors into submission. Such are the intricacies of the human psychology.


The RSA weakness only applies to the key exchange and establishing the session. If the attacker doesn't catch this, the actual communication itself is far more resistant to brute force with the 256 bit symmetric encryption. (Though both are currently way, way beyond impossible to brute force. Key reduction attacks that could come up in the future could make it a significant difference, but that isn't known now.) The RSA is the weakpoint, but that doesn't mean that it isn't worth using higher security for the persistent portion of the connection/session.

Tags:

Encryption

Tls