5 ms·

Is your concern the same whether a single static key used for the entire message vs. a cryptosystem that offers forward secrecy; or solely based around the idea

Is your concern the same whether a single static key used for the entire message vs. a cryptosystem that offers forward secrecy; or solely based around the idea that having the (encrypted) content publicly disseminated in the first place is an unacceptable risk that enables offline cryptanalysis and, in the case of a very patient attacker, data hoarding? Is your threat model different from, say, a state-level MitM, who today can record IP traffic that happens to include TLS and simply wait the equivalently long time until the underlying ciphers are broken and obsolete? Is the information being exchanged of such sensitivity to require outlasting a typical human lifespan, making the possibility of offline cryptanalysis, enabled by the dissemination of still-encrypted content, an unacceptable risk? If the cryptosystems themselves have comparable properties, do ancillary factors make, say, the I2P DHT usecase worse than the TLS-over-the-public-web usecase, given that a darknet overlay network typically has a self-selecting clientele vs. the vast numbers of people defaultly using TLS, making publicly accessible but encrypted blobs traversing the former more tempting targets in a smaller haystack?

Klathmon 9y ago
I can't speak for the parent commenter, but just about every cryptosystem created has made the claim that the data secured will be secure for "longer than a typical human lifespan", and yet time and time again that is shown to be false. Attacks are found, cryptosystems are broken, key strengths weakened, side channel attacks created, computers get faster, dedicated hardware is created, etc... Pretending that we got it 100% right this time seems naive at best, and adding a small amount of "defense in depth" by not giving everyone all of the encrypted data seems like a good place to start.
- the8472 9y ago
  > side channel attacks created not applicable to offline decryption and of fairly limited use in asynchronous communication > computers get faster, dedicated hardware is created not relevant with 256bit keys. Even grover's algorithm would only cut it down to 128bits which is still "boiling the oceans" territory. So at least in that area we have a lot more safety margin than in the past. Of course none of that is a guarantee that the data will stay secure, but you can't just generalize all attacks used in the past and then count them against a system where we learned from some mistakes and others simply aren't applicable.
saurik 9y ago
> Is the information being exchanged of such sensitivity to require outlasting a typical human lifespan, making the possibility of offline cryptanalysis, enabled by the dissemination of still-encrypted content, an unacceptable risk? Even if I believed in cryptography that outlasted human lifespans (and in general I do not for the same reason as the other person who replied to your comment) I have a difficult time accepting a world where it is simply considered reasonable to have every single letter sent by every single person before 1930 (including your great grandparents when they were teenagers) accessible to anyone today (not just state level actors, but literally any person who cared, such as me) who has access to an archive (and like, why not keep one? it almost seems silly not to: I can even see some people making it their life's mission to archive the data for the next generation to decrypt) and wants to bother reading (or indexing and searching and analyzing) that content.
- the8472 9y ago
  Isn't that what archaeology does to dead people anyway?

Klathmon 9y ago

I can't speak for the parent commenter, but just about every cryptosystem created has made the claim that the data secured will be secure for "longer than a typical human lifespan", and yet time and time again that is shown to be false. Attacks are found, cryptosystems are broken, key strengths weakened, side channel attacks created, computers get faster, dedicated hardware is created, etc... Pretending that we got it 100% right this time seems naive at best, and adding a small amount of "defense in depth" by not giving everyone all of the encrypted data seems like a good place to start.

the8472 9y ago
> side channel attacks created not applicable to offline decryption and of fairly limited use in asynchronous communication > computers get faster, dedicated hardware is created not relevant with 256bit keys. Even grover's algorithm would only cut it down to 128bits which is still "boiling the oceans" territory. So at least in that area we have a lot more safety margin than in the past. Of course none of that is a guarantee that the data will stay secure, but you can't just generalize all attacks used in the past and then count them against a system where we learned from some mistakes and others simply aren't applicable.

saurik 9y ago

> Is the information being exchanged of such sensitivity to require outlasting a typical human lifespan, making the possibility of offline cryptanalysis, enabled by the dissemination of still-encrypted content, an unacceptable risk? Even if I believed in cryptography that outlasted human lifespans (and in general I do not for the same reason as the other person who replied to your comment) I have a difficult time accepting a world where it is simply considered reasonable to have every single letter sent by every single person before 1930 (including your great grandparents when they were teenagers) accessible to anyone today (not just state level actors, but literally any person who cared, such as me) who has access to an archive (and like, why not keep one? it almost seems silly not to: I can even see some people making it their life's mission to archive the data for the next generation to decrypt) and wants to bother reading (or indexing and searching and analyzing) that content.

the8472 9y ago
Isn't that what archaeology does to dead people anyway?