3 ms·

I think the big unknown unknown would be something along the lines of a hypothetical mathematical breakthrough that renders current cryptography useless. I'm no

I think the big unknown unknown would be something along the lines of a hypothetical mathematical breakthrough that renders current cryptography useless. I'm not even suggesting quantum computing. Suppose someone figures out a way to rapidly factor large numbers easily using classical computing? Yes, we dont know how to do it now, but there have been a lot of things we didnt know how to do or was thought impossible 20, 50, 100 years ago. I dont have any special insight to this, just saying that what was once impossible can become a daily occurance in time and with the right breakthrough.

zahllos 7y ago
Factoring large numbers won't have any effect on symmetric cryptography. Finite field cryptography, if you want to call it that (DH, RSA) requires the primes be big enough to generate sufficiently large finite fields for all algorithms that might factor or solve dlog to be so expensive to run you can't do it. Same with elliptic curves - the finite fields are chosen to be large enough to make the best algorithms that can solve the ecdlp impossible within our lifetime, modulo either quantum computers or a major classical speedup. At a very high level (I'm about to take liberties with the entire field), symmetric cryptography is a permutation of bits in the input block. To make it secure we need two things: confusion and diffusion. We don't want the relationship between plaintext, key and ciphertext to be simple to describe, and every time a bit is flipped, we want approximately half the output bits to be flipped. There's actually very little mathematics involved here: you can describe AES in terms of finite fields, but there's no hard to inverse problem in place. It's simply that finite fields a) conveniently describe binary in characteristic 2 (AES uses GF(2^8) which can be represented as 8 bits, or one byte) and b) have "weird" multiplication even when using the most obvious characteristic polynomial, which AES does not. Actually I think this was mildly controversial at the time, because it implies some structure (and we generally want no evidence of structure of any kind). Cryptanalysis, in this context, tries to find "chinks" in this confusion and diffusion. Imagine if you took two plaintexts, what happens if you start doing things like encrypting the xor of them, versus encrypting one or the other? Doing this with enough plaintext/ciphertext pairs gives us enough information to find the key being used, eventually. Or what happens if we can make linear approximations to parts of the cipher? Can we use this to take shortcuts and guess the key? Have a read of http://theamazingking.com/crypto-diff.php http://theamazingking.com/crypto-diff.php and the linear stuff there. This is the best we have. tl;dr factoring large numbers, or any advance in the mathematical areas has little bearing on symmetric cryptography. What we need is a way to see structure in something that has been deliberately designed to have as little as possible. Of course, nobody knows, but I'd guess that it's more likely someone will find a speedup for the ecdlp than any meaningful improvement to block cipher cryptanalysis.

zahllos 7y ago

Factoring large numbers won't have any effect on symmetric cryptography. Finite field cryptography, if you want to call it that (DH, RSA) requires the primes be big enough to generate sufficiently large finite fields for all algorithms that might factor or solve dlog to be so expensive to run you can't do it. Same with elliptic curves - the finite fields are chosen to be large enough to make the best algorithms that can solve the ecdlp impossible within our lifetime, modulo either quantum computers or a major classical speedup. At a very high level (I'm about to take liberties with the entire field), symmetric cryptography is a permutation of bits in the input block. To make it secure we need two things: confusion and diffusion. We don't want the relationship between plaintext, key and ciphertext to be simple to describe, and every time a bit is flipped, we want approximately half the output bits to be flipped. There's actually very little mathematics involved here: you can describe AES in terms of finite fields, but there's no hard to inverse problem in place. It's simply that finite fields a) conveniently describe binary in characteristic 2 (AES uses GF(2^8) which can be represented as 8 bits, or one byte) and b) have "weird" multiplication even when using the most obvious characteristic polynomial, which AES does not. Actually I think this was mildly controversial at the time, because it implies some structure (and we generally want no evidence of structure of any kind). Cryptanalysis, in this context, tries to find "chinks" in this confusion and diffusion. Imagine if you took two plaintexts, what happens if you start doing things like encrypting the xor of them, versus encrypting one or the other? Doing this with enough plaintext/ciphertext pairs gives us enough information to find the key being used, eventually. Or what happens if we can make linear approximations to parts of the cipher? Can we use this to take shortcuts and guess the key? Have a read of http://theamazingking.com/crypto-diff.php http://theamazingking.com/crypto-diff.php and the linear stuff there. This is the best we have. tl;dr factoring large numbers, or any advance in the mathematical areas has little bearing on symmetric cryptography. What we need is a way to see structure in something that has been deliberately designed to have as little as possible. Of course, nobody knows, but I'd guess that it's more likely someone will find a speedup for the ecdlp than any meaningful improvement to block cipher cryptanalysis.