On Thu, Sep 29, 2022 at 10:36:55AM +0200, Cyborg via Exim-users wrote: > Am 28.09.22 um 17:51 schrieb Viktor Dukhovni via Exim-users: > > I strongly disagree. There's no need to be a crypto > > exhibitionist/maximalist. The vast majority of issuing CA RSA keys are > > 2048-bits. The use of 4096-bit keys is pointless waste of CPU, > > There is a BSI ( the german cybersecurity agency ) guideline for german > corps and gov entities, which states, that 2048 bit RSA keys, for any > purpose, > should not be used anymore in 2022.
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-1.pdf?__blob=publicationFile&v=10 Comment to table 3.1: | For a period of use beyond 2022, it is recommended to use RSA/DLIES | keys of 3000 bits length to achieve a consistent level of security in | all recommended asymmetric encryption schemes. The key length of 2000 | bits will remain compliant with this Technical Guideline for DLIES | keys until the end of 2022, and also transitionally for RSA keys until | the end of 2023. So, BSI statement is significantly different from what you wrote. > Can you state, why you think, that this 2048 bit key is only used for > authentication, rather than for TLS encryption? I think, it is used, as it's > presented on port 25. You have better to study basics of TLS, really. -- Eugene Berdnikov -- ## List details at https://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
