Strong cryptography: Difference between revisions

Revision as of 07:48, 27 March 2024

Latest revision as of 19:45, 6 February 2025

(One intermediate revision by one other user not shown)

Line 21:

An encryption algorithm is intended to be unbreakable (in which case it is as strong as it can ever be), but might be breakable (in which case it is as weak as it can ever be) so there is not, in principle, a continuum of strength as the [[idiom]] would seem to imply: Algorithm A is stronger than Algorithm B which is stronger than Algorithm C, and so on. The situation is made more complex, and less subsumable into a single strength metric, by the fact that there are many types of [[Cryptanalysis|cryptanalytic]] attack and that any given algorithm is likely to force the attacker to do more work to break it when using one attack than another.

There is only one known unbreakable cryptographic system, the [[one-time pad]], which is not generally possible to use because of the difficulties involved in exchanging one-time pads without theirthem being compromised. So any encryption algorithm can be compared to the perfect algorithm, the one-time pad.

The usual sense in which this term is (loosely) used, is in reference to a particular attack, [[Brute force attack|brute force]] key search — especially in explanations for newcomers to the field. Indeed, with this attack (always assuming keys to have been randomly chosen), there is a continuum of resistance depending on the length of the key used. But even so there are two major problems: many algorithms allow use of different length keys at different times, and any algorithm can forgo use of the full key length possible. Thus, [[Blowfish (cipher)|Blowfish]] and [[RC5]] are [[block cipher]] algorithms whose design specifically allowed for several [[Key size|key lengths]], and who cannot therefore be said to have any particular strength with respect to brute force key search. Furthermore, US export regulations restrict key length for exportable cryptographic products and in several cases in the 1980s and 1990s (e.g., famously in the case of [[Lotus Notes]]' export approval) only partial keys were used, decreasing 'strength' against brute force attack for those (export) versions. More or less the same thing happened outside the [[United States|US]] as well, as for example in the case of more than one of the cryptographic algorithms in the [[Global System for Mobile Communications|GSM]] cellular telephone standard.

Line 79:

* Almost all [[classical cipher]]s.

* Most rotary ciphers, such as the [[Enigma machine]].

* RSA keys weaker than 2048 bits.{{cn|date=July 2023}}

* DH keys weaker than 2048 bits.{{cn|date=July 2023}}

* ECDHE keys weaker than 192 bits; also, not all known older named curves still in use for this are vetted "safe".{{cn|date=July 2023}}

* DHE/EDHE is guessable/weak when using/re-using known default prime values on the server

* The [[Cipher block chaining|CBC]] block cipher mode of operation is considered weak for TLS (the CCM/GCM modes are now recommended).{{cn|date=July 2023}}

==Notes==