DES, pretty much the first strong civilian encryption algorithm, is crackable due to brute-forcing the 56-bit key space, which has been pointed out as a security problem almost 50 years ago, but in terms of cryptanalysis it's doing ok.
AES will turn 25 soon and the best cryptanalyses today are like a factor four faster than brute-force (but require rather significant memory, which brute force doesn't), which is basically nothing.
> On average, to brute-force attack AES-256, one would need to try 2^255 keys. (This is the total size of the key space divided by 2, because on average, you'll find the answer after searching half the key space.) So the time taken to perform this attack, measured in years, is simply 2^255 / 2,117.8 trillion
> Expressed as an exponent of 10, that’s 2.73 * 1061. Written in full format:
>27,337,893,038, 406,611, 194,430,009, 974,922,940, 323,611,067, 429,756,962, 487,493,203 years.
>In English: 27 trillion trillion trillion trillion trillion years.
From-https://scrambox.com/article/brute-force-aes/
I’d love to hear Hacker News opinions on how long that will be valid due to faster computers, quantum computing etc. Or if it will always pretty much be valid in your opinion?
The number they get for all the PCs on earth trying it is still 13,689 trillion trillion trillion trillion years. The universe is only 14 billion years old and estimates of what the universe will be like in even a trillion years are more like science fiction than science because it is so wildly long.
I really enjoyed reading it.
Bremermann's Limit[1] puts a fundamental limit on the rate of computation for any given amount of mass of about 1.36e50 bit changes/second/kg. Unless you get an amount of mass of literally planetary scale (as large as, say, Mercury) to take part in your computation the time will be enormous even for a 256-bit key.
More seriously, GPUs are faster because they are highly parallel, and parallelism can only give you a speedup that is linear with the number of processing units. So unless you're planning to build a GPU with trillions units, that won't help much.
If it looks like someone is going to build a quantum computer out of the entire mass of the silicon in Earth's crust, I suggest 512-bit keys. That'll keep your secrets safe for about 9E73 years. I'd also suggest finding a new planet to live on, the mining operation would likely be somewhat disruptive.
For a more realistic comparison, perhaps they've only got a computer with as much mass of iron ore as the recent annual world production for the last thousand years (2.5E9 tonnes/year = 2.5E15 kg). Then it'll take around 5000 to run 2^255 operations.
Light speed delays are not relevant to a highly concurrent problem. They would be an issue for a general purpose computer that size running a sequential program.
Either way it's a bit beyond what's economically possible for any human organization right now. And I implicitly assumed the computation is fully reversible and therefore took negligible energy.
“We generalize Grover's”…
“We extend the analysis to the case of a society of k quantum searches acting in parallel”.
Disclaimer: I know absolutely nothing about the topic, but the first link I googled seems to justify my intuition that this decryption could be partitioned so that many quantum computers could run in parallel (thus avoiding the limit on speed of information transfer you are hypothesising).
> Either way it's a bit beyond what's economically possible for any human organization right now. And I implicitly assumed the computation is fully reversible and therefore took negligible energy.
Agree - I’m just being that contrary Internet!
AES is still believed to be quantum resistant.
So encryption will still work in a quantum world. We 'just' have to update the algorithms we use.
See also: https://csrc.nist.gov/projects/post-quantum-cryptography/rou... https://en.wikipedia.org/wiki/Post-quantum_cryptography
Quantum computing could allow an implementation of Shor's algorithm to exist. This algorithm breaks RSA which is the basis of a lot of asymmetric cryptographic implementations such as TLS and SSH. By breaking here we mean that it is trivial to crack. It is unclear right now whether or not an equivalent attack applies to elliptic curve-based algorithms which are gaining in popularity.
As far as symmetric encryption is concerned, the standard right now is AES-128 and AES-256 and might be vulnerable to Grover's algorithm which would effectively half the effective number of bits so AES-128 becomes roughly equivalent to a non-existing AES-64 which would be somewhat trivial to crack. However, data encrypted with AES-256 would simply go down to AES-128 which is still considered "good enough" as of today.
In practice, by the time we have real quantum computers there will be a new standard for both of asymmetric and symmetric encryption so it does not matter as much as one would think.
TLDR: RSA will break, elliptic curves might break, AES will be weakened and the impact on your life will probably be minimal.
There's no indication that it can be used to break several other types of problem that can be used in asymmetric cryptography. These other problems are less efficient and have different trade-offs (some have huge keys, some have huge outputs, some are really slow) and picking appropriate parameters to make them usable while still being secure is a difficult problem. Solving that is the aim of NIST's post-quantum standardization effort.
[1] https://crypto.stackexchange.com/questions/51346/shors-algor...