Is it true the longer the key length is the more secure the encryption? Then why don't we use xxxxxxx bits encryption? what stopping us from using a very lengthy key?
I am referring to the encryption we use with SSL
Is it true the longer the key length is the more secure the encryption?


No. Key length does put an upper bound on security, because it determines the complexity of brute force iteration of the key space or factoring, discrete log, etc. for some asymmetric algorithms. However, once you have a long enough key to make brute force attacks impossible, there is no benefit to a longer key alone, you must have a stronger algorithm in general (e.g. more rounds, larger state or block size) to benefit.

For some asymmetric systems, like RSA, it may seem that you can just increase the numbers and call it a day. However, RSA security rests on the encryption and signature algorithms which probably use symmetric encryption and hash functions that have a constant security, limiting that of the whole algorithm.

As a practical example, RC4 allows up to 2048-bit keys but has biases in the initial keystream no matter which size you use. Meanwhile, many ciphers with 128-bit keys are thought to be secure, like AES-128 or HC-128.


  what stopping us from using a very lengthy key?


Diminishing returns, performance costs and increasing complexity.

The effect of key length on performance is most readily apparent in something like RSA, where modular exponentiation takes about $O(n^{k})$ time for $n$-bit numbers ($k &gt; 2$ depends on the algorithm). Longer keys usually mean longer key schedules, which may be more difficult to analyze, require more constants and code, etc. adding to complexity.