6 ms·

Or it was simply cheaper than cracking it.

by danielheath 1y ago

hx8 1y ago
I was comforted by the idea that it is more expensive than $10m to crack encryption, but this was in 2013.
- greenavocado 1y ago
  Earth's oceans contain approximately 1.35 billion cubic kilometers of water. To raise this entire volume from an average temperature of 3.5C to boiling (100 C), we'd need roughly: 1.35 x 10^21 kg x 4,184 J/(kg C) x 96.5C is approximately 5.45 x 10^25 joules That's 545 million exajoules or about 10,000 times humanity's annual energy consumption. If you tried to brute-force AES-256 with conventional computers, you'd need to check 2^256 possible keys. Even with a billion billion (10^18) attempts per second: 2^256 operations / 10^18 operations/second is approximately 10^59 seconds. You'd need about 2.7 x 10^41 universe lifetimes to crack AES-256 At about 10 watts per computer, this would require approximately 10^60 joules, or roughly 2 x 10^34 times the energy needed to boil the oceans. You could boil the oceans, refill them, and repeat this process 200 trillion trillion trillion times. For RSA-2048, the best classical algorithms would need about 2^112 operations. This would still require around 10^27 joules, or about 20 times what's needed to boil the oceans. ECC with a 256-bit key would need roughly 2^128 operations to crack, requiring approximately 10^31 joules It's enough to boil the oceans about 2,000 times over. Quantum computers could theoretically use Shor's algorithm to break RSA and ECC much faster. But to break RSA-2048, we'd need a fault-tolerant quantum computer with millions of qubits. Current quantum computers have fewer than 1,000 stable qubits. Even with quantum computing, the energy requirements would still be astronomical. Perhaps enough to boil all the oceans once or twice, rather than thousands of times.
  - gosub100 1y ago
    > you'd need to check 2^256 possible keys it's very unlikely you'd have to check the entire keyspace before you found it. On average it would be about half.
    - greenavocado 1y ago
      Is there a more efficient way? What's the state of the art?
      - timschmidt 1y ago
        IDK, let's ask a mathematician. Oh, they all work for NSA.
        aaronbrethorst 1y ago
        Womp womp. https://therecord.media/nsa-to-cut-up-to-2000-roles-downsizing https://therecord.media/nsa-to-cut-up-to-2000-roles-downsizi...
        timschmidt 1y ago
        I like to tell myself that everyone at NSA is a fine upstanding patriot, and that the agency only ever does what is in the best interest of the American People, but that does feel naive at times. Like when they infiltrate international standards bodies to introduce backdoors. Is downsizing the NSA something we're upset about?
        akimbostrawman 1y ago
        It doesn't even really matter what character most of them have. Most information is on need to know basis for a reason so the one giving the orders can tell a tale about foreign terrorists while the grunts happily surveil the common man.
        gosub100 1y ago
        Or when they walk out the door with gigabytes of secret data in their pocket.
      - bb88 1y ago
        If you can find a quantum computing solution it's at worst O(sqrt(n)). There still seems to be a time factor, if not energy factor to computation. Shor's algorithm for factoring prime numbers is at best O(log(n)^2 * log(log(n)))
  - swyx 1y ago
    is there a hall of fame for HN comments somewhere because i nominate this one
    - j_bum 1y ago
      I want to steal this as a copypasta
      - kbelder 1y ago
        I don't think you'd be the first.
      - buran77 1y ago
        The "boiling the ocean" argument comes up every once in a while for some time now, just a lot more structured and number packed in the age of LLMs. There are even funny "security" levels based on this [0] like "lake security". The picture they paint is very useful to help people grasp the scale of "worst case" brute forcing while being completely misleading on the effort needed to break encryption "somehow". Cracking the encryption isn't usually about brute forcing every possible combination, it's all about finding or building a flaw in the algorithm. Bike thieves don't go through the 10000 combinations on your lock, scammers don't try every possible email password, etc. Brute forcing a key finds you one answer at a time, hacking the algorithm finds you all answers at once. Without boiling the ocean. [0] https://asecuritysite.com/blog/2018-08-05_Boiling-Every-Ocean-on-the-Planet---16-384-times---To-Crack-A-Single-Key-a371fff425b3.html https://asecuritysite.com/blog/2018-08-05_Boiling-Every-Ocea...
        greenavocado 1y ago
        An adversary with full Intel Management Engine (IME) access could intercept AES-NI instruction calls before execution, replacing them with compromised implementations that maintain superficial compliance with expected behaviors. The encryption would still function much like a funeral home makeup artist ensures the deceased appears lifelike. These direct instruction interceptions occur at a level below the operating system and hypervisor, making them essentially invisible to security monitoring. The IME's DMA capabilities enable memory inspection without host awareness. Cryptographic keys residing in RAM become visible to this subsystem, essentially placing the combination to the digital vault in plain view of an entity designed never to be seen. One might say the keys to the kingdom are being displayed on a billboard visible only to those standing in another dimension. This extraction could happen before legitimate AES-NI operations even process the key material. Random number generation becomes particularly vulnerable. By introducing subtle biases to hardware entropy sources like CPU thermal or timing sensors, an adversary could ensure generated keys fall within a predictable pattern while presenting all appearances of randomness. Statistical tests would show nothing amiss, like a perfectly balanced coin that somehow lands heads 51% of the time over millions of flips, a mathematical miracle that passes unnoticed until the casino's bankruptcy. These manipulations would bias the PRNG to produce predictable entropy patterns that drastically reduce effective key space. Microcode updates deployed through IME channels could modify AES-NI instruction behavior at its core, ensuring the cryptographic equivalent of building a vault door with steel exterior panels but papier-mache hinges. Everything looks secure until someone approaches from the correct angle. These updates could specifically target the AES-NI implementation to use reduced key space or introduce mathematical weaknesses into the diffusion properties of the algorithm. Side-channel attack facilitation presents another avenue for compromise. The IME could enable precise timing measurements of AES operations, deliberately increase susceptibility to cache-timing attacks, and manipulate power states to enhance the effectiveness of power analysis techniques while appearing to function normally. The most effective entropy reduction strategy would likely combine several approaches: replacing the AES-NI implementation with one that only explores a fraction of the key space, creating deterministic but seemingly random patterns for key generation, leaking key material via covert channels to the IME's persistent storage, and maintaining the outward appearance of full entropy while drastically reducing actual security margins. Detection of such tampering remains virtually impossible given the IME's isolated execution environment. Security researchers can only examine the results of cryptographic operations, unable to observe the process directly similar to trying to determine if someone has tampered with your food while blindfolded. The mathematics of AES remain sound, of course. But mathematics requires faithful execution to maintain security guarantees, and therein lies the fundamental issue.
  - 0xbadcafebee 1y ago
    That's assuming there's no attacks found in a given algorithm. If there is a feasible attack found, the math changes, sometimes dramatically. And we'll never know it because they sure as hell aren't gonna announce it. Anyway, I'm not worried because governments don't need to crack encryption to do dastardly shit. They have far easier methods to get what they want.
    - cenamus 1y ago
      Also just picking constants for encryption algorithms that are supposed to be "nothing up my sleeve" numbers, like the n first digits of pi. DJB had a good talk about how many degrees of freedom you can still get picking such numbers and how much you can weaken crypto algorithms (even though not outright breaking them), but I can't find it at the moment
  - kragen 1y ago
    This is an excellent comment, but I think it's worth pointing out some lacunae. The most important one is that we're assuming that nobody finds a weakness in AES-256, so we have to brute-force it instead of taking some kind of shortcut. Historically speaking, that doesn't seem like a sure bet. (Some slight progress has been made on AES, but nothing practically useful yet: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Known_attacks https://en.wikipedia.org/wiki/Advanced_Encryption_Standard#K...) Similar comments apply to factoring large semiprimes and ECDLP; algorithmic improvements could remove many orders of magnitude from these estimates. Sometimes, even when weaknesses aren't known in the algorithms themselves, there are weaknesses in how they are applied. The Debian OpenSSL fiasco, which seems to have been accidental, may be the best-known example: all secret keys were generated with only 16 bits of entropy. Reusing IVs for OFB or CTR mode is also catastrophic. A somewhat pedantic note is that you seem to be using two conflicting definitions of "boil the oceans" in different parts of your comment: to raise them to the boiling temperature while leaving them liquid, at first, and to convert them to vapor, later, since you talk about "refilling them". Converting them to vapor requires several times more energy than that. Also, you dropped an order of magnitude somewhere; raising the oceans to boiling requires 5.46 × 10²⁶ J, not 5... × 10²⁵ as you say. ("545 million exajoules" is correct.) I used `cal_mean` from units(1) to do the calculation, which is based on the mean specific heat of water from 1° to 100°. I'm not sure that's correct for salt water, though, and in any case that's a minor error. "about 10,000 times humanity's annual energy consumption" is wrong. 545 million exajoules is about a million years of humanity's energy consumption, which is only about 18 terawatts, excluding agriculture. As gosub100 pointed out, on average you only have to try 2²⁵⁵ possible keys before finding the right one, not all 2²⁵⁶, but that's only a factor of 2. 10¹⁸ AES attempts per second does seem like a reasonable upper bound, but it's much faster than currently existing encryption hardware. 10¹⁸ Hz is the frequency of 0.3-nanometer X-rays with an energy of about 4000 electron volts. I feel like any computer hardware that is performing operations that fast probably cannot be made out of molecules or atoms. You might be able to build it on the surface of a neutron star or a black hole. Seth Lloyd's Nature paper from 02000 on the "ultimate laptop", "Ultimate physical limits to computation", explores some of the physical phenomena involved, and how fast they could possibly compute: https://faculty.pku.edu.cn/_resources/group1/M00/00/0D/cxv0BF5mC6CALoznAAR9fsim1hM046.pdf https://faculty.pku.edu.cn/_resources/group1/M00/00/0D/cxv0B... If we take 10¹⁸ Hz and 2²⁵⁶ cycles as given, it is true that one computer would need 10⁵⁹ seconds to finish the job (4×10⁵¹ years), which is indeed about 2.7 × 10⁴¹ times longer than the universe has existed so far (13.79 billion years). But it's worth pointing out that the universe's lifetime is not yet over; it is expected to continue existing much longer than that: https://en.wikipedia.org/wiki/Timeline_of_the_far_future https://en.wikipedia.org/wiki/Timeline_of_the_far_future lists various stages of its future evolution, including the end of star formation in 10¹²–10¹⁴ years, the last star burning out in 1.2 × 10¹⁴ years, 10³⁰ years until all the galaxies fall apart, 2×10³⁶–3×10⁴³ years until all protons and neutrons are gone (if protons decay), 10⁹¹ years until the Milky Way's black hole evaporates, and 10¹⁰⁶–2.1×10¹⁰⁹ years until the last black holes evaporate. If protons are stable, you could definitely build a computer that kept computing for the necessary 10⁵² years. And (as you point out next!) you could use more than one computer. If you could somehow use 10⁵⁹ computers, you could finish the job in a second, rather than in untold eons. It depends on how many computers you can get! "10 watts" is a somewhat handwavy estimate. Most of the computers around me, in things like my multimeter and my MicroSD card, use a lot less power than that, often a few milliwatts. (The fact that the MicroSD card doesn't have a monitor and keyboard is irrelevant to using it for AES cracking.) I'm currently working on a project called the Zorzpad, to build a self-sufficient portable personal computing environment on under a milliwatt, something that has become possible recently due to advancements in subthreshold digital logic. But even a milliwatt may be an overestimate for AES cracking on classical hardware, because reversible logic may be able to drop power consumption by one or more additional orders of magnitude, and as far as we know, there's no lower limit (not even the ones Lloyd's article talks about apply). AES cracking is especially suited for reversible computing, which is why I used it as an example in this comment a week ago: https://news.ycombinator.com/item?id=43850835 https://news.ycombinator.com/item?id=43850835 It may be worth pointing out that 10⁶⁰ joules (which, despite the possible weaknesses above in its derivation, is certainly a plausible ballpark) is a large number not just measured against Earth, but measured against the Sun and indeed the energy output of the entire Milky Way galaxy. It's even large compared to the available energy in the Milky Way. If you divide it by c² you get 1.2 × 10⁴³ kg. The Milky Way weighs 1.15 × 10¹² solar masses (https://en.wikipedia.org/wiki/Milky_Way https://en.wikipedia.org/wiki/Milky_Way) which turns out to be 2.29 × 10⁴² kg, which is 2.06 × 10⁵⁹ J. So even if you converted the entire galaxy into energy to power your AES crackers, you wouldn't get 10⁶⁰ J. It's probably worth including AES performance numbers on currently available hardware. You'll still get galactic numbers demonstrating that AES-256 is not currently brute-forceable.
  - rightbyte 1y ago
    You need to account for the heat of vaporization if you plan on boil away and refilling the oceans for your brute force scheme, so you overestimate how many times you will boil away the oceans by a factor of 6 or something.
  - chokma 1y ago
    For more calculations about the use of (computational) brute force: https://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html https://www.schneier.com/blog/archives/2009/09/the_doghouse_... "... brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.
  - k0ns0l 1y ago
    [dead]
- nullc 1y ago
  Wrong assumption. Lets imagine they could costslessly crack the encryption there. But as soon as they use any information gathered that way they risk leaking that they have this incredibly valuable capability. ... valuable and very fragile since people can easily change encryption schemes. Better to pay every party you need to to have boring vulnerabilities and security shortcomings, so that any information leak doesn't need a capabilities revealing explanation. So I think this gives you no information on their capabilities beyond bribing commercial players, which isn't exactly new. In the past (and presumably now) our intelligence apparatus has outright owned crypto/security companies in order to distribute backdoored technology. And of course they have, they're not prohibited, it's highly effective, they'd be incompetent not to.
  - bb88 1y ago
    But knowing still gives you an advantage, even if you can't use it legally -- because you can still use it illegally. LEO and Prosecutors will use "parallel construction" to construct a narrative about how information was obtained in a legal way even though it was clearly obtained illegally. Or you could choose to only act on 5% (e.g.) of the information gleaned -- and that which could clearly be shown to be leaked by a third party. Or say if you were tapping the information of a mob boss, you could leak the information to a competitor and let justice work it's way through the streets instead of the courts.
    - nullc 1y ago
      It's tricky, because you run the risk that any use risks disclosing the capability. Targets can even set traps. E.g. I caught irc opers spying on PMs by sending trap URLs where I secretly could see the access logs. Because great care was taken to make sure the URLs existed nowhere else when they got loaded it was a confirmation that the traffic was monitored. Now perhaps a somewhat safer tool is to just use the cracking to determine the best targets to bribe or backdoor, but only allow the group with the cracking power to give the names of services to monitor at any cost.
      - bb88 1y ago

Or it was simply cheaper than cracking it.

hx8 1y ago

I was comforted by the idea that it is more expensive than $10m to crack encryption, but this was in 2013.

greenavocado 1y ago
Earth's oceans contain approximately 1.35 billion cubic kilometers of water. To raise this entire volume from an average temperature of 3.5C to boiling (100 C), we'd need roughly: 1.35 x 10^21 kg x 4,184 J/(kg C) x 96.5C is approximately 5.45 x 10^25 joules That's 545 million exajoules or about 10,000 times humanity's annual energy consumption. If you tried to brute-force AES-256 with conventional computers, you'd need to check 2^256 possible keys. Even with a billion billion (10^18) attempts per second: 2^256 operations / 10^18 operations/second is approximately 10^59 seconds. You'd need about 2.7 x 10^41 universe lifetimes to crack AES-256 At about 10 watts per computer, this would require approximately 10^60 joules, or roughly 2 x 10^34 times the energy needed to boil the oceans. You could boil the oceans, refill them, and repeat this process 200 trillion trillion trillion times. For RSA-2048, the best classical algorithms would need about 2^112 operations. This would still require around 10^27 joules, or about 20 times what's needed to boil the oceans. ECC with a 256-bit key would need roughly 2^128 operations to crack, requiring approximately 10^31 joules It's enough to boil the oceans about 2,000 times over. Quantum computers could theoretically use Shor's algorithm to break RSA and ECC much faster. But to break RSA-2048, we'd need a fault-tolerant quantum computer with millions of qubits. Current quantum computers have fewer than 1,000 stable qubits. Even with quantum computing, the energy requirements would still be astronomical. Perhaps enough to boil all the oceans once or twice, rather than thousands of times.
- gosub100 1y ago
  > you'd need to check 2^256 possible keys it's very unlikely you'd have to check the entire keyspace before you found it. On average it would be about half.
  - greenavocado 1y ago
    Is there a more efficient way? What's the state of the art?
    - timschmidt 1y ago
      IDK, let's ask a mathematician. Oh, they all work for NSA.
      - aaronbrethorst 1y ago
        Womp womp. https://therecord.media/nsa-to-cut-up-to-2000-roles-downsizing https://therecord.media/nsa-to-cut-up-to-2000-roles-downsizi...
        timschmidt 1y ago
        I like to tell myself that everyone at NSA is a fine upstanding patriot, and that the agency only ever does what is in the best interest of the American People, but that does feel naive at times. Like when they infiltrate international standards bodies to introduce backdoors. Is downsizing the NSA something we're upset about?
        akimbostrawman 1y ago
        It doesn't even really matter what character most of them have. Most information is on need to know basis for a reason so the one giving the orders can tell a tale about foreign terrorists while the grunts happily surveil the common man.
        gosub100 1y ago
        Or when they walk out the door with gigabytes of secret data in their pocket.
    - bb88 1y ago
      If you can find a quantum computing solution it's at worst O(sqrt(n)). There still seems to be a time factor, if not energy factor to computation. Shor's algorithm for factoring prime numbers is at best O(log(n)^2 * log(log(n)))
- swyx 1y ago
  is there a hall of fame for HN comments somewhere because i nominate this one
  - j_bum 1y ago
    I want to steal this as a copypasta
    - kbelder 1y ago
      I don't think you'd be the first.
    - buran77 1y ago
      The "boiling the ocean" argument comes up every once in a while for some time now, just a lot more structured and number packed in the age of LLMs. There are even funny "security" levels based on this [0] like "lake security". The picture they paint is very useful to help people grasp the scale of "worst case" brute forcing while being completely misleading on the effort needed to break encryption "somehow". Cracking the encryption isn't usually about brute forcing every possible combination, it's all about finding or building a flaw in the algorithm. Bike thieves don't go through the 10000 combinations on your lock, scammers don't try every possible email password, etc. Brute forcing a key finds you one answer at a time, hacking the algorithm finds you all answers at once. Without boiling the ocean. [0] https://asecuritysite.com/blog/2018-08-05_Boiling-Every-Ocean-on-the-Planet---16-384-times---To-Crack-A-Single-Key-a371fff425b3.html https://asecuritysite.com/blog/2018-08-05_Boiling-Every-Ocea...
      - greenavocado 1y ago
        An adversary with full Intel Management Engine (IME) access could intercept AES-NI instruction calls before execution, replacing them with compromised implementations that maintain superficial compliance with expected behaviors. The encryption would still function much like a funeral home makeup artist ensures the deceased appears lifelike. These direct instruction interceptions occur at a level below the operating system and hypervisor, making them essentially invisible to security monitoring. The IME's DMA capabilities enable memory inspection without host awareness. Cryptographic keys residing in RAM become visible to this subsystem, essentially placing the combination to the digital vault in plain view of an entity designed never to be seen. One might say the keys to the kingdom are being displayed on a billboard visible only to those standing in another dimension. This extraction could happen before legitimate AES-NI operations even process the key material. Random number generation becomes particularly vulnerable. By introducing subtle biases to hardware entropy sources like CPU thermal or timing sensors, an adversary could ensure generated keys fall within a predictable pattern while presenting all appearances of randomness. Statistical tests would show nothing amiss, like a perfectly balanced coin that somehow lands heads 51% of the time over millions of flips, a mathematical miracle that passes unnoticed until the casino's bankruptcy. These manipulations would bias the PRNG to produce predictable entropy patterns that drastically reduce effective key space. Microcode updates deployed through IME channels could modify AES-NI instruction behavior at its core, ensuring the cryptographic equivalent of building a vault door with steel exterior panels but papier-mache hinges. Everything looks secure until someone approaches from the correct angle. These updates could specifically target the AES-NI implementation to use reduced key space or introduce mathematical weaknesses into the diffusion properties of the algorithm. Side-channel attack facilitation presents another avenue for compromise. The IME could enable precise timing measurements of AES operations, deliberately increase susceptibility to cache-timing attacks, and manipulate power states to enhance the effectiveness of power analysis techniques while appearing to function normally. The most effective entropy reduction strategy would likely combine several approaches: replacing the AES-NI implementation with one that only explores a fraction of the key space, creating deterministic but seemingly random patterns for key generation, leaking key material via covert channels to the IME's persistent storage, and maintaining the outward appearance of full entropy while drastically reducing actual security margins. Detection of such tampering remains virtually impossible given the IME's isolated execution environment. Security researchers can only examine the results of cryptographic operations, unable to observe the process directly similar to trying to determine if someone has tampered with your food while blindfolded. The mathematics of AES remain sound, of course. But mathematics requires faithful execution to maintain security guarantees, and therein lies the fundamental issue.
- 0xbadcafebee 1y ago
  That's assuming there's no attacks found in a given algorithm. If there is a feasible attack found, the math changes, sometimes dramatically. And we'll never know it because they sure as hell aren't gonna announce it. Anyway, I'm not worried because governments don't need to crack encryption to do dastardly shit. They have far easier methods to get what they want.
  - cenamus 1y ago
    Also just picking constants for encryption algorithms that are supposed to be "nothing up my sleeve" numbers, like the n first digits of pi. DJB had a good talk about how many degrees of freedom you can still get picking such numbers and how much you can weaken crypto algorithms (even though not outright breaking them), but I can't find it at the moment
- kragen 1y ago
  This is an excellent comment, but I think it's worth pointing out some lacunae. The most important one is that we're assuming that nobody finds a weakness in AES-256, so we have to brute-force it instead of taking some kind of shortcut. Historically speaking, that doesn't seem like a sure bet. (Some slight progress has been made on AES, but nothing practically useful yet: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Known_attacks https://en.wikipedia.org/wiki/Advanced_Encryption_Standard#K...) Similar comments apply to factoring large semiprimes and ECDLP; algorithmic improvements could remove many orders of magnitude from these estimates. Sometimes, even when weaknesses aren't known in the algorithms themselves, there are weaknesses in how they are applied. The Debian OpenSSL fiasco, which seems to have been accidental, may be the best-known example: all secret keys were generated with only 16 bits of entropy. Reusing IVs for OFB or CTR mode is also catastrophic. A somewhat pedantic note is that you seem to be using two conflicting definitions of "boil the oceans" in different parts of your comment: to raise them to the boiling temperature while leaving them liquid, at first, and to convert them to vapor, later, since you talk about "refilling them". Converting them to vapor requires several times more energy than that. Also, you dropped an order of magnitude somewhere; raising the oceans to boiling requires 5.46 × 10²⁶ J, not 5... × 10²⁵ as you say. ("545 million exajoules" is correct.) I used `cal_mean` from units(1) to do the calculation, which is based on the mean specific heat of water from 1° to 100°. I'm not sure that's correct for salt water, though, and in any case that's a minor error. "about 10,000 times humanity's annual energy consumption" is wrong. 545 million exajoules is about a million years of humanity's energy consumption, which is only about 18 terawatts, excluding agriculture. As gosub100 pointed out, on average you only have to try 2²⁵⁵ possible keys before finding the right one, not all 2²⁵⁶, but that's only a factor of 2. 10¹⁸ AES attempts per second does seem like a reasonable upper bound, but it's much faster than currently existing encryption hardware. 10¹⁸ Hz is the frequency of 0.3-nanometer X-rays with an energy of about 4000 electron volts. I feel like any computer hardware that is performing operations that fast probably cannot be made out of molecules or atoms. You might be able to build it on the surface of a neutron star or a black hole. Seth Lloyd's Nature paper from 02000 on the "ultimate laptop", "Ultimate physical limits to computation", explores some of the physical phenomena involved, and how fast they could possibly compute: https://faculty.pku.edu.cn/_resources/group1/M00/00/0D/cxv0BF5mC6CALoznAAR9fsim1hM046.pdf https://faculty.pku.edu.cn/_resources/group1/M00/00/0D/cxv0B... If we take 10¹⁸ Hz and 2²⁵⁶ cycles as given, it is true that one computer would need 10⁵⁹ seconds to finish the job (4×10⁵¹ years), which is indeed about 2.7 × 10⁴¹ times longer than the universe has existed so far (13.79 billion years). But it's worth pointing out that the universe's lifetime is not yet over; it is expected to continue existing much longer than that: https://en.wikipedia.org/wiki/Timeline_of_the_far_future https://en.wikipedia.org/wiki/Timeline_of_the_far_future lists various stages of its future evolution, including the end of star formation in 10¹²–10¹⁴ years, the last star burning out in 1.2 × 10¹⁴ years, 10³⁰ years until all the galaxies fall apart, 2×10³⁶–3×10⁴³ years until all protons and neutrons are gone (if protons decay), 10⁹¹ years until the Milky Way's black hole evaporates, and 10¹⁰⁶–2.1×10¹⁰⁹ years until the last black holes evaporate. If protons are stable, you could definitely build a computer that kept computing for the necessary 10⁵² years. And (as you point out next!) you could use more than one computer. If you could somehow use 10⁵⁹ computers, you could finish the job in a second, rather than in untold eons. It depends on how many computers you can get! "10 watts" is a somewhat handwavy estimate. Most of the computers around me, in things like my multimeter and my MicroSD card, use a lot less power than that, often a few milliwatts. (The fact that the MicroSD card doesn't have a monitor and keyboard is irrelevant to using it for AES cracking.) I'm currently working on a project called the Zorzpad, to build a self-sufficient portable personal computing environment on under a milliwatt, something that has become possible recently due to advancements in subthreshold digital logic. But even a milliwatt may be an overestimate for AES cracking on classical hardware, because reversible logic may be able to drop power consumption by one or more additional orders of magnitude, and as far as we know, there's no lower limit (not even the ones Lloyd's article talks about apply). AES cracking is especially suited for reversible computing, which is why I used it as an example in this comment a week ago: https://news.ycombinator.com/item?id=43850835 https://news.ycombinator.com/item?id=43850835 It may be worth pointing out that 10⁶⁰ joules (which, despite the possible weaknesses above in its derivation, is certainly a plausible ballpark) is a large number not just measured against Earth, but measured against the Sun and indeed the energy output of the entire Milky Way galaxy. It's even large compared to the available energy in the Milky Way. If you divide it by c² you get 1.2 × 10⁴³ kg. The Milky Way weighs 1.15 × 10¹² solar masses (https://en.wikipedia.org/wiki/Milky_Way https://en.wikipedia.org/wiki/Milky_Way) which turns out to be 2.29 × 10⁴² kg, which is 2.06 × 10⁵⁹ J. So even if you converted the entire galaxy into energy to power your AES crackers, you wouldn't get 10⁶⁰ J. It's probably worth including AES performance numbers on currently available hardware. You'll still get galactic numbers demonstrating that AES-256 is not currently brute-forceable.
- rightbyte 1y ago
  You need to account for the heat of vaporization if you plan on boil away and refilling the oceans for your brute force scheme, so you overestimate how many times you will boil away the oceans by a factor of 6 or something.
- chokma 1y ago
  For more calculations about the use of (computational) brute force: https://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html https://www.schneier.com/blog/archives/2009/09/the_doghouse_... "... brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.
- k0ns0l 1y ago
  [dead]
nullc 1y ago
Wrong assumption. Lets imagine they could costslessly crack the encryption there. But as soon as they use any information gathered that way they risk leaking that they have this incredibly valuable capability. ... valuable and very fragile since people can easily change encryption schemes. Better to pay every party you need to to have boring vulnerabilities and security shortcomings, so that any information leak doesn't need a capabilities revealing explanation. So I think this gives you no information on their capabilities beyond bribing commercial players, which isn't exactly new. In the past (and presumably now) our intelligence apparatus has outright owned crypto/security companies in order to distribute backdoored technology. And of course they have, they're not prohibited, it's highly effective, they'd be incompetent not to.
- bb88 1y ago
  But knowing still gives you an advantage, even if you can't use it legally -- because you can still use it illegally. LEO and Prosecutors will use "parallel construction" to construct a narrative about how information was obtained in a legal way even though it was clearly obtained illegally. Or you could choose to only act on 5% (e.g.) of the information gleaned -- and that which could clearly be shown to be leaked by a third party. Or say if you were tapping the information of a mob boss, you could leak the information to a competitor and let justice work it's way through the streets instead of the courts.
  - nullc 1y ago
    It's tricky, because you run the risk that any use risks disclosing the capability. Targets can even set traps. E.g. I caught irc opers spying on PMs by sending trap URLs where I secretly could see the access logs. Because great care was taken to make sure the URLs existed nowhere else when they got loaded it was a confirmation that the traffic was monitored. Now perhaps a somewhat safer tool is to just use the cracking to determine the best targets to bribe or backdoor, but only allow the group with the cracking power to give the names of services to monitor at any cost.
    - bb88 1y ago