4 ms·
Yeah, we are using the current crypto algorithms as if they would continue to be strong in 20,30,40 years. So many secrets encrypted "only" with current-industr
by est31 8y ago
Yeah, we are using the current crypto algorithms as if they would continue to be strong in 20,30,40 years. So many secrets encrypted "only" with current-industry-grade crypto.
This is better than not encrypting at all but overall it's foolish to assume that cracking capabilities won't improve. "Perfect forward secrecy" only helps against compromised long-term keys, but it doesn't help against entities who store vast amounts of encrypted internet traffic in facilities in, say Bluffdale. And then once these algorithms can be cracked they will have a gigantic valuable trove of data.
The 2010s have seen major players adopting encryption that is proof against current attackers, with one event being the launch of encrypted.google.com in 2010 [0]. Hopefully in the 2020s we'll see major players adopting algorithms that are proof against future attackers.
It isn't guaranteed that we can ever build quantum computers that can crack current industry grade encryption nor is it guaranteed that computing capabilities as well as theoretical advances will improve enough, but we are betting too much onto that we can't ever. E.g. there are proposals in Germany to upload health data to the cloud and even if it is end-to-end encrypted, the data, once decrypted, stays highly valuable throughout the life of the patient, see the recent 35c3 talk on this if you know German [2].
Thankfully, there is an open NIST competition on post-quantum crypto [3] [4] (added a second link because the first is currently dead), but this isn't enough, as there may be theoretical attacks on them as well.
Quantum based encryption is quite valuable here because it gives a physical guarantee but it's also really tough to roll out and probably won't be deployed in consumer devices for a while.
[0]: https://googleblog.blogspot.com/2010/05/search-more-securely-with-encrypted.html https://googleblog.blogspot.com/2010/05/search-more-securely...
[2]: https://media.ccc.de/v/35c3-9992-all_your_gesundheitsakten_are_belong_to_us https://media.ccc.de/v/35c3-9992-all_your_gesundheitsakten_a...
[3]: https://csrc.nist.gov/Projects/Post-Quantum-Cryptography https://csrc.nist.gov/Projects/Post-Quantum-Cryptography
[4]: http://web.archive.org/web/20181225214652/https://csrc.nist.gov/Projects/Post-Quantum-Cryptography http://web.archive.org/web/20181225214652/https://csrc.nist....