Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've read that cracking 128-bit key is currently out of reach of all humanity. However, I can't seem to find any information on what scope of brute force attacks have been performed or are possible at the current time. Can someone provide some information on this subject with quotable reference?

share|improve this question
Do you need sentences/phrases to quote, or could you quote this? – Ricky Demer Apr 10 '12 at 0:17
@RickyDemer Some paper would be ideal, but probably the website will do. – ThePiachu Apr 10 '12 at 0:36
up vote 8 down vote accepted

The last major effort I know of for cracking keys was the effort.

You can find the project page at In 2002, they cracked a 64-bit RC5 key using at total of 331,252 computers over 1,757 days. Their maximum throughput was "equivalent to 32,504 800MHz Apple PowerBook G4 laptops or 45,998 2GHz AMD Athlon XP machines or (to use some rc5-56 numbers) nearly a half million Pentium Pro 200s." as it said in their press release.

At the time, they moved on to doing a 72-bit key, which would be 256 times harder.

If we do some Moore-Law-type hand waving, we'd see a $2^7$ (128×) increase in compute power in ten years. That means that if you started today, it would only be twice as hard as breaking 64-bits was a decade ago. Doable, but not many people would actually want to bother.

Even if you're a government, buying a zero-day exploit and tailoring your own malware would be cheaper.

share|improve this answer

Any symmetric crypto with key length of 64 bits or less can be brute forced with the relatively cheap copacobana hardware.

If a major player built special purpose hardware like this filling racks with $256$ copacobanas in parallel, they would in theory be able to brute force keys of $2 ^ {64 + 8} = 2 ^ {72}$ bits. But that is still a long way from 128 bits. To brute force 128 bits, you would have to connect $2 ^ {128-64} = 2 ^{64}$ copacobanas. That is just too many to be practically doable. Maybe it will be possible in 10 to 20 years or so, who knows. By then everybody has surely switched to 256 bit keys or longer anyway.

share|improve this answer

I am currently enrolled in an online course of cryptography by Prof. Dan Boneh of Stanford University. In one of the lectures, he told that currently algorithms where the brute force attack requires less than $2^{90}$ trials are weak and anything above that is safe. So, 128-bit is currently out of reach of the fastest machine present on earth, as it requires $2^{128}$ trials to crack it.

share|improve this answer

For RSA, the factoring challenge for 768 bit RSA modulus was met in December 2009. Authors published their procedure here. What this means is that if you have a RSA private key of 768 bit, you are potentially vulnerable to practical factoring attack with hardware available today.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.