3 ms·
Assume that over some time frame a crypto solution (the entire system matters as it's very easy to use encryption insecurely) will be compromised. You are esse
by mey 13y ago
Assume that over some time frame a crypto solution (the entire system matters as it's very easy to use encryption insecurely) will be compromised. You are essentially buying yourself time. So the question is how much time do you need to buy yourself.
Ok, so even if you select a key length of something very large which depends not only on bytes of the key but also the encryption algorithm as well. For a 4096 bit key that would be 1.0443888814131525066917527107166e+1233 combinations, assuming someone tried to brute force this at 100000 checks per second (a low estimate) it would take roughly 1.655867708988382335571652572800330388413185326368886003... × 10^1220 years to crack on average assuming the birthday paradox.
2^4096 / 2 / 100000 / 60 / 60 / 24 / 365
So that's a freaking long time to keep that data secure. Even radically scaling up the brute force attack across the entire world would be akin to boiling the oceans. (Not going to do out the cpu/watt/check number calculation to determine how much energy it would actually take compared to boiling the oceans...)
So are you safe? No because starting in WWII very smart mathematicians were finding ways to crack the algorithms and find patterns and holes in the encryption solutions that made the search space orders of magnitude smaller. So the best thing we can do is select well attacked, well researched but still secure systems, use a good key length and pray (I am not a religious man).
Edit: If you wish to be truly paranoid (don't recommend it), most of the important crypto research has been done by state organizations, this is how AES was selected from a group of submitted designs to NIST. Conversely there are few still secure and well researched algorithms besides AES out there, (Elliptic Curve basically, but those designs are under patents so not widely available etc)
Edit 2: Also wikipedia is a great starting point for understanding, but is not always complete. Still haven't seen it probably explain initialization vector or nounces before.
Oh and one last thing http://xkcd.com/538/ http://xkcd.com/538/
See
https://en.wikipedia.org/wiki/Key_size https://en.wikipedia.org/wiki/Key_size
https://en.wikipedia.org/wiki/Brute-force_search https://en.wikipedia.org/wiki/Brute-force_search
https://blogs.oracle.com/dcb/entry/zfs_boils_the_ocean_consumes https://blogs.oracle.com/dcb/entry/zfs_boils_the_ocean_consu...
https://en.wikipedia.org/wiki/World_War_II_cryptography https://en.wikipedia.org/wiki/World_War_II_cryptography
https://en.wikipedia.org/wiki/Advanced_Encryption_Standard https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
https://en.wikipedia.org/wiki/Elliptic_curve_cryptography https://en.wikipedia.org/wiki/Elliptic_curve_cryptography
- Xcelerate 13y agoI'm not sure you saw the last part of my post :) I mentioned the same thing about brute-forcing and focused on the mathematical weaknesses aspect of it. I have written some ECDSA code myself from scratch so I am familiar at least with the very basics of it.
- mey 13y agoYeah I think I started writing before I really got your question, my apologies :) It is very possible that government based research on crypto cracking is several years ahead of the rest of the world, but the attitude to these systems around the time of the dot com bubble was switching from security through obscurity to working in the open. The reason is the research cuts both ways, the US relies on AES as much as you or I. If there is a problem with it, they would be burned as well.
- jlgaddis 13y ago> the US relies on AES as much as you or I Yes, but the government also has other (non-public) algorithms/ciphers/etc. that are used internally.
- enoch-root 13y agoI don't know why you're saying Elliptic Curve is not widely available, here is an Elliptic Curve Diffie-Hellman implementation guide from the NSA itself: http://www.nsa.gov/ia/_files/SuiteB_Implementer_G-113808.pdf http://www.nsa.gov/ia/_files/SuiteB_Implementer_G-113808.pdf Those patents are quite questionable anyway: https://en.wikipedia.org/wiki/ECC_patents https://en.wikipedia.org/wiki/ECC_patents