Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Ok, I just jumped into crypto and now struggling with some points…

I read lots of resources, most of them mention how important the strength of the encryption key is. However, I could not find much info about that.

What if the encryption key is not generated randomly and somehow is fixed or easy to be guessed? And what if the key contains lots of zeros in it? What could be the security risks?

share|improve this question
up vote 3 down vote accepted

A usual approach to security analysis is that the attacker knows everything about the system except the secret key, and often he has access to an "oracle" to produce related data. This is also known as Kerckhoffs's principle. For example in a chosen plaintext attack he can choose some messages, hand them to the oracle which encrypts them under the secret key and gets back the ciphertexts.

Back to your question: If the key is chosen poorly (and if there is some structure, the attacker knows it), it might be possible just to brute force it and try all possible keys. Today's computers can deal with complexities of testing $\approx 2^{64}$, therefore DES is no longer safe to use. If you know the first 100 bit of a 128 bit key are all 0 bits, then you probably are even able to find the key on any modern computer larger than a mobile phone.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.