• Is the cost to performance of using larger key length not cost effective?
  • How would it negatively impact anyone if some hosts decided to use a larger key length (i.e. Why isn't anyone free to manually use a larger key length if they so choose for their hidden service)?
  • In terms of brute force resistance how does the current 1024 length RSA keys stand up against AES 128 used by several HTTPS sites.
  • Is perfect forward secrecy built into the encryption used with hidden services? If not, are there plans to include it in future Tor versions?
  • Are there plans to eventually increase mandatory and/or default onion RSA key length beyond 1024? And if not, when might we see this topic become reviewed (for example, is the current strength and implementation of the protocol considered good enough that we should expect no further work done on it in several years time?)?
  • 1
    One big issue is that changing the key length would also necessarily change the length and form of .onion addresses. I hope this gets done soon though... Commented Nov 9, 2013 at 1:46

2 Answers 2


There is a proposal to add Ed25519 keys in version 0.2.5


RSA asymmetric encryption works really slowly, and the bigger the n and the message is, the harder the computer is going to have to work, thats why PGP exists.

Note that RSA encryption works by:
message pow e mod n

PGP encrypts the symmetric encryption key for the message in RSA/DSA/ElGamel and then encrypt the message with IDEA, and make encryption/decryption significantly faster.

AES192 is sufficient for most things in the world, in fact, when AES256 was in operation, cryptographers described it an overkill.

Don't expect RSA1024 to be cracked in the near future, because when RSA 768 was, 2000 2.2Ghz Opertron CPUs and 3 years time was used.

  • Also note that AES-256 has some weaknesses that AES-192 does not have. Commented Oct 23, 2015 at 7:32
  • Those weaknesses are for related keys, which is not an issue the way it is used in Tor (or virtually any good protocol). Without related key attacks, AES-256 is more secure, primarily due to the greater number of rounds (14 instead of 10) and the difficulty of batch attacks.
    – forest
    Commented Feb 17, 2019 at 12:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .