3 ms·

You can always keep the encrypted data until technology has advanced far enough to easily decrypt it.

tialaramex 5y ago
There's an excellent chance you will wait forever. I'm going to give the same example I always do. In 1977 they standardised DES. DES was already publicly known to be weak in two specific ways, the keys are too short (56-bits), and the block size is too small (64-bits). This was done intentionally. Today you can break DES... by exploiting these two weaknesses with today's cheaper hardware. No other meaningful attacks on DES worked, it has performed exactly as designed for well over forty years. At the turn of the century DES was replaced by AES. AES has 128-bit or 256-bit keys, and 128 bit blocks. So, brute force attacks known to be viable for DES are never going to be possible for AES because physics. You would need one of those mathematical breakthroughs that never happened for DES in, as I wrote, almost fifty years. Don't hold your breath. Because of this, encrypted material probably gets less valuable over time, as keys which did exist and might become available to you in future are instead lost or destroyed. And the pace accelerates. With TLS 1.2 it was plausible that you (assuming "you" are a powerful adversary able to do stuff like seize people's property) could seize a running HTTPS server and use its "ephemeral" secrets to decrypt traffic from yesterday, or maybe even last week, but in TLS 1.3 the mechanism is more fleeting, perhaps you can decrypt messages from ten minutes ago, but without the client's help perhaps not at all.
- tinus_hn 5y ago
  Storage is almost free so you can easily afford to wait just about forever, you don’t need to crack AES to crack TLS because you can also crack the key exchange or find a weakness in the RNG or the algorithm and we all know everybody knows something is impossible until someone comes around and does it.
  - brigandish 5y ago
    The perfect is the enemy of the good. By that I mean that there is no perfect security, at some point, if given long enough, security of any system (computer or otherwise) can/will be broken. The point is to slow it down for long enough that it is of no use. I have to wonder what kind of information is useful enough to wait forever for? What kind of personal information of mine, for example, will be useful after I'm dead? There may be something. Even if we look at state actors it doesn't change - if China's government manages to decrypt something the UK has that is useful now, like some advanced technology, will it still be advanced when its encryption is cracked? Slow them down for even 20 years and it'll be too long to wait.
    - tinus_hn 5y ago
      These are generic platitudes that are not very useful. Obviously you can’t consider whether some random guys data is interesting when you are capturing it in an encrypted state. You just capture everything just in case. And who knows, a way might suddenly appear to decrypt all of it and then you won’t be happy if you didn’t capture it.
      - brigandish 5y ago
        Yes, knowing that any data captured cannot be decrypted until after I’m dead is definitely generic as I don’t know anyone who will live long enough for decryption to happen in their lifetime, do you? If not, then you’re wrong about it being a platitude because you’ve given absolutely no reason how that data will be useful, other than ”who knows, a way might suddenly appear to decrypt all of it”. Maybe they’ll also invent a time machine but I’d prefer to stick to the realms of reality rather than sci-fi when assessing risk.
  - hilbert42 5y ago
    "Storage is almost free so you can easily afford to wait just about forever." Forever is a long time. The point made above is valid, which is that data devalues greatly over time. Take in point the famous case of the Zodiac Killer: https://en.m.wikipedia.org/wiki/Zodiac_Killer https://en.m.wikipedia.org/wiki/Zodiac_Killer. Recent work seems to suggest that his encrypted messages are close to being solved (decrypted). If in fact we do have a solution and we've learned his identity then this information is of much less value now than if it would have been available 50+ years ago. For starters, it seems the killer is now dead. Thus, being able to decrypt his messages after this lengh of time is of little practical use other than of academic interest and or offering some resolution to his victims' families. The value of encrypted data held by the NSA and GCHQ in anticipation of finding a decryption key will rot in exactly the same way. In short, it's only worth keeping the data whilst it's potentially useful.
- Hikikomori 5y ago
  If DES had larger key sizes would it have remained uncracked?
  - tialaramex 5y ago
    3DES is essentially DES with larger key sizes (effectively twice as long, choosing 3 x 56 bit keys, ie 168 bits gets you a cipher equivalent to 112 bits of strength due to the meet-in-the-middle attack on such constructions) at a price of being three times as expensive to use. So, almost enough security to be acceptable, at a price of being far slower. But, 3DES is still DES, the blocks are still 64 bits which is too small. Sweet32 is an example of a more-or-less practical attack (practical enough to demo, but probably never used in anger) that breaks 3DES for HTTPS by "just" moving a couple of hundred gigabytes of data over the wire. Lucifer (the cipher that the NSA cut down to make DES) used 128-bit keys and 128-bit blocks. It is vulnerable to differential cryptanalysis (which the NSA knew about before academics discovered it, and so the NSA fixed it in DES). If you imagine Lucifer was instead fixed by a similar technique to the one used in DES but not shortened to provide a NOBUS there's no obvious reason Lucifer would be insecure today. There are most sophisticated analysis techniques than differential cryptanalysis today, but the defences in DES warded those off, and so you might expect similar for Lucifer.
jodrellblank 5y ago
What are you practically going to do with the decrypted secret records of Phillip II of Spain (1556 – 1598), the James A Garfield administration (1881), or suspected spy Joe Bloggs of San Francisco 1930-2000 ?
- CharlesW 5y ago
  If nothing else, it can increase our understanding of history: https://www.sciencenews.org/article/marie-antoinette-letters-ink-analysis-hidden-words-censor https://www.sciencenews.org/article/marie-antoinette-letters...
webdelv 5y ago
It's probably cheaper to scrape all the keys than try to crack it

There's an excellent chance you will wait forever. I'm going to give the same example I always do. In 1977 they standardised DES. DES was already publicly known to be weak in two specific ways, the keys are too short (56-bits), and the block size is too small (64-bits). This was done intentionally. Today you can break DES... by exploiting these two weaknesses with today's cheaper hardware. No other meaningful attacks on DES worked, it has performed exactly as designed for well over forty years. At the turn of the century DES was replaced by AES. AES has 128-bit or 256-bit keys, and 128 bit blocks. So, brute force attacks known to be viable for DES are never going to be possible for AES because physics. You would need one of those mathematical breakthroughs that never happened for DES in, as I wrote, almost fifty years. Don't hold your breath. Because of this, encrypted material probably gets less valuable over time, as keys which did exist and might become available to you in future are instead lost or destroyed. And the pace accelerates. With TLS 1.2 it was plausible that you (assuming "you" are a powerful adversary able to do stuff like seize people's property) could seize a running HTTPS server and use its "ephemeral" secrets to decrypt traffic from yesterday, or maybe even last week, but in TLS 1.3 the mechanism is more fleeting, perhaps you can decrypt messages from ten minutes ago, but without the client's help perhaps not at all.

tinus_hn 5y ago
Storage is almost free so you can easily afford to wait just about forever, you don’t need to crack AES to crack TLS because you can also crack the key exchange or find a weakness in the RNG or the algorithm and we all know everybody knows something is impossible until someone comes around and does it.
- brigandish 5y ago
  The perfect is the enemy of the good. By that I mean that there is no perfect security, at some point, if given long enough, security of any system (computer or otherwise) can/will be broken. The point is to slow it down for long enough that it is of no use. I have to wonder what kind of information is useful enough to wait forever for? What kind of personal information of mine, for example, will be useful after I'm dead? There may be something. Even if we look at state actors it doesn't change - if China's government manages to decrypt something the UK has that is useful now, like some advanced technology, will it still be advanced when its encryption is cracked? Slow them down for even 20 years and it'll be too long to wait.
  - tinus_hn 5y ago
    These are generic platitudes that are not very useful. Obviously you can’t consider whether some random guys data is interesting when you are capturing it in an encrypted state. You just capture everything just in case. And who knows, a way might suddenly appear to decrypt all of it and then you won’t be happy if you didn’t capture it.
    - brigandish 5y ago
      Yes, knowing that any data captured cannot be decrypted until after I’m dead is definitely generic as I don’t know anyone who will live long enough for decryption to happen in their lifetime, do you? If not, then you’re wrong about it being a platitude because you’ve given absolutely no reason how that data will be useful, other than ”who knows, a way might suddenly appear to decrypt all of it”. Maybe they’ll also invent a time machine but I’d prefer to stick to the realms of reality rather than sci-fi when assessing risk.
- hilbert42 5y ago
  "Storage is almost free so you can easily afford to wait just about forever." Forever is a long time. The point made above is valid, which is that data devalues greatly over time. Take in point the famous case of the Zodiac Killer: https://en.m.wikipedia.org/wiki/Zodiac_Killer https://en.m.wikipedia.org/wiki/Zodiac_Killer. Recent work seems to suggest that his encrypted messages are close to being solved (decrypted). If in fact we do have a solution and we've learned his identity then this information is of much less value now than if it would have been available 50+ years ago. For starters, it seems the killer is now dead. Thus, being able to decrypt his messages after this lengh of time is of little practical use other than of academic interest and or offering some resolution to his victims' families. The value of encrypted data held by the NSA and GCHQ in anticipation of finding a decryption key will rot in exactly the same way. In short, it's only worth keeping the data whilst it's potentially useful.
Hikikomori 5y ago
If DES had larger key sizes would it have remained uncracked?
- tialaramex 5y ago
  3DES is essentially DES with larger key sizes (effectively twice as long, choosing 3 x 56 bit keys, ie 168 bits gets you a cipher equivalent to 112 bits of strength due to the meet-in-the-middle attack on such constructions) at a price of being three times as expensive to use. So, almost enough security to be acceptable, at a price of being far slower. But, 3DES is still DES, the blocks are still 64 bits which is too small. Sweet32 is an example of a more-or-less practical attack (practical enough to demo, but probably never used in anger) that breaks 3DES for HTTPS by "just" moving a couple of hundred gigabytes of data over the wire. Lucifer (the cipher that the NSA cut down to make DES) used 128-bit keys and 128-bit blocks. It is vulnerable to differential cryptanalysis (which the NSA knew about before academics discovered it, and so the NSA fixed it in DES). If you imagine Lucifer was instead fixed by a similar technique to the one used in DES but not shortened to provide a NOBUS there's no obvious reason Lucifer would be insecure today. There are most sophisticated analysis techniques than differential cryptanalysis today, but the defences in DES warded those off, and so you might expect similar for Lucifer.

jodrellblank 5y ago

What are you practically going to do with the decrypted secret records of Phillip II of Spain (1556 – 1598), the James A Garfield administration (1881), or suspected spy Joe Bloggs of San Francisco 1930-2000 ?

CharlesW 5y ago
If nothing else, it can increase our understanding of history: https://www.sciencenews.org/article/marie-antoinette-letters-ink-analysis-hidden-words-censor https://www.sciencenews.org/article/marie-antoinette-letters...

webdelv 5y ago

It's probably cheaper to scrape all the keys than try to crack it