Google Starts Upgrading Its SSL Certificates To 2048-bit Keys

An anonymous reader writes "Google today announced it has already started upgrading all of its SSL certificates to 2048-bit keys. The goal is to beef up the encryption on the connections made to its services. Google says the upgrade, which includes the root certificate that the company uses to sign all of its SSL certificates, will be completed 'in the next few months.' Previously, however, Google was more specific and said it was aiming to finish the process by the end of 2013."

Comments

Completely useless...

[Anonymous Coward]

If the NSA has the master key...

Re:Completely useless...

[telchine]

It's called private key, you cretin. Now, go smoke some weed and don't bother the grown-ups will you?

Let me draw you a picture...

Me <---- (SSL) ----> Google ---- (SSL) ----> NSA

Re:Completely useless...

[noh8rz10]

I love how this is an article about how goog is increasing security, yet 95% of the posts are about NSA snooping. This is the flip side of the PRISM stuff - a company will never be able to prove that NSA is NOT snooping. Once the public loses faith, it will be really hard for a company to regain it. maybe this has already happened...

Older PCs

[MightyMait]

I wonder how this'll affect older PCs? Aren't SSL communications with larger keys more processor-intensive than when using a smaller key?

Re:Older PCs

[Anonymous Coward]

If you really worry about SSL key lengths affecting your system performance. You probably should buy a new one.

Re:Older PCs

[tlhIngan]

I wonder how this'll affect older PCs? Aren't SSL communications with larger keys more processor-intensive than when using a smaller key?

Hardly anything, actually. The actual amount of encryption and decryption done using the RSA2048 key is quite small - really only about 128 to 256 bits or so.

Public key encryption is horrendously slow, too slow for modern usage, so what happens is the bulk encryption is done via a symmetric cipher, typically AES these days (previously it was 3DES or DES). Of course, for symmetric ciphers to work, you need to share a key. So what happens is the client generates a key for AES, encrypts it with the RSA2048 public key, and sends it to the server. The server decrypts the key using its RSA2048 private key and then communications take place via AES and that shared key.

The change from RSA1024 to RSA2048 should have minimal impact since it's only done on session setup while the actual communications use the far faster and more secure AES algorithm.

(Yes, public key encryption is weaker - you need more bits for the key to have the same level of protection as a symmetric cipher using way less bits.).

Key size not the flaw...

[sabt-pestnu]

The largest risk isn't during transmission, it is at the user's end... and Google's end. 2 million bit encryption wouldn't be enough if you had a keylogger, or if google got served a National Security Letter that it decided to honor.

Not really.

[Anonymous Coward]

The initial connection setup will be more processor intensive (4x?) but the actual communications isn't done with public/private key encryption. The public/private keys are only used to verify the identity of the server and to exchange a symmetric (AES128 often) key. After the setup, the rest of the transfer will be no more complex and so shouldn't load your PC any more than before.

Big deal.

[magic maverick]

I've been using 4096 bit keys for over two years. Now if only /. would get into the act (I don't want freaks and weirdos at where ever I use the 'net to know a. what stories I read. b. whether I'm logged in or not. c. if I'm logged in, what my user name and password are).

Also, the moderators are all insufficiently like the "ideal" for their gender (whatever gender that is). E.g. the male identifying mods all have small penis'.

2048 bytes? Pure blinkered American-centric bias..

[Dogtanian]

The Yanks are so used to accessing Google on their bloated 2K TS-1000s, that they seem to have forgetten that those of us with the original British 1K ZX81 won't be able to access their website securely any more.

I bet those tossers are so spoiled they have blackjack and hookers, and 16K rampacks on their servers. Hope someone wobbles them (*) and they lose all their data. Gits.

(*) The rampacks, I mean. I've no idea what wobbling a hooker would do to your data.

Re:WTF?

[hawguy]

How the fuck is "by the end of 2013" more specific than "in the next few months"? First is a 5 month range, the second "generally" refers to a 2-4 month range. At worst there timeline response hasn't changed.

"By the end of 2013" specifies an exact point in time at which the project will be done - Dec 31st, 2013, if they slip past that date, then they are late. However, "in the next few months" is very non specific, with no universally accepted definition of what it means and can depend on the range being considered -- If I have big bag of M&M's and someone asks me for a "few", they'd probably be disappointed if I gave them 2 - 4. Since "few" is so non-specific, they could stretch it out to 5 months and still claim they are within a "few".

Re:Doesn't need to...

[steveb3210]

Most of the time when you hear that it takes "thousands of years" to factor a prime number

Really? I can factor most primes in my head.. Semiprimes would be a different story...