10
$\begingroup$

So, browsing through YouTube, I stumbled on this video interview of John Draper (Captain Crunch), one of the first "hackers". He talks for about 3 minutes (until 27:48) about his home rolled encryption method that will use 1 billion bit keys that randomly change every 5 seconds.

My first thought is, is this guy full of crap? But, more specifically, if we have the capability to use 1 billion bit encryption (he claims an overhead of only 250kb to transport keys), why don't we see keys much longer than 4096? Other than the fact that it seems like an insane overkill.

$\endgroup$
7
  • 1
    $\begingroup$ How about 9 trillion bit cryptography? $\endgroup$ Commented Jan 29, 2015 at 4:54
  • 18
    $\begingroup$ Ridiculous key lengths are one of the primary indicators of bullshit in the crypto world. "Proprietary" schemes are another. Winning a game of buzzword bingo within the first sentence seals the deal. Physical limits on computation mean there's no need for such excessively long keys. Even though public-key crypto has inherently easier attacks than symmetric crypto, there's no point in going that big. Bremermann's limit means that brute forcing a 512-bit symmetric key with a computer the mass of the earth would take 10^72 years. ECC needs keys >=2x that of symmetric to get the same security. $\endgroup$ Commented Jan 29, 2015 at 5:44
  • $\begingroup$ I have justifiably considered 8 terabit encryption before. $\endgroup$
    – Joshua
    Commented Jan 29, 2015 at 22:11
  • 6
    $\begingroup$ Non-experts stating "we need larger keys" usually don't understand (unbounded) exponential growth. That is a very unnatural pattern, which basically never exists in the real world (even if a growth pattern starts out exponentially, it always has some boundary and is actually logistic growth). So if you ask "how much do we have to increase the length to double the time for an attack or 'double security'", they will answer with "double key size" instead of "increase by one bit". Partially, this can be attributed to cryptanalysis in movies, where ciphers are broken digit by digit. $\endgroup$
    – tylo
    Commented Jan 30, 2015 at 12:07
  • $\begingroup$ Just for the record, don't forget there are some exotic crypto usages (homomorphic, etc.) that do actually require extremely large key sizes at the moment. $\endgroup$
    – Dillinur
    Commented Feb 2, 2015 at 9:55

3 Answers 3

23
$\begingroup$

Examining his claims about "Thundercloud":

  • You can use it with "any existing software, operating system, or device" (a massive amount of effort---by whom?)
  • Has its "own cryptographic language that is completely independent of any existing security technology" (this is a negative thing: abandoning the entire knowledge base of cryptography is incredibly stupid)
  • Its strength is "built within [its] proprietary design of the public and private cryptographic keys" (proprietary design is not a strength)
  • Those keys are 1 billion bits (125 megabytes!!!)
  • Those keys are "rotated randomly every 5 seconds" (a generation rate of 200 megabits per second)
  • Those keys are "controlled entirely by the user" (how they can generate 200 megabits per second is beyond me)
  • "No information is ever stored... the size of our standard encryption key is in excess of a terabyte data block" (???)
  • However, the above is what makes their technology so exciting---since it's transferred in the space of 200 kilobytes! (what?)
  • Will conform to any existing method of data storage or communication without any overhead
  • "Most security keys range from 128-bit to 4096-bit" (I guess the range includes both symmetric and asymmetric encryption!)
  • Since "most" security keys are so small, "cracking security keys in this size is fairly easy with enough computational power" (of course this is true---by definition, "enough" computational power will break computational security; that's kind of the point)
  • Current cryptographic technology is no longer safe: even RSA crypto was discovered to have "back doors" (yes, recently a blog post circulated showing that RSA can be backdoored if you let someone else control key generation, but that is practically a non-issue)
  • The system is designed from the ground-up to be impossible to breach
  • Every supercomputer in the world in tandem can't break it! (Neither can they break ChaCha20 with its 256-bit key, though, either......)
  • Adding tracking elements to Thundercloud is "technically impossible"

Needless to say, I am very skeptical. He certainly uses many technical terms, but there's very little substance. Sporting massive key sizes are a telltale sign of bullshit.

Answering your question directly: 128-bit encryption is generally considered very sufficient. Maybe it is not very sufficient: then you can pick 256-bit, whose breaking by exhaustive search is "totally out of reach of Mankind".

If exhaustive search of a 256-bit keyspace is totally out of reach of Mankind, why should you use 1 billion bit keys? Even if you built a system that could, is the massive overhead of trying to use a 1-billion-bit key really worth it? I wouldn't say so: not when 256-bit keys suffice.

Some schemes can be broken much faster than by doing an exhaustive search. For example, to get "256 bits of security," you need 15360 bits for RSA, so there's an example of needing a really, really, really large key to attain a certain security level. (Also, notice that I'm saying 15Kbits is really, really, really large. Imagine how I must feel about a gigabit!)

(Almost?) all practical cryptosystems might be broken in the near future, so we can't say that 256-bit encryption with, say, ChaCha20 gives you ironclad, unstoppable security. At the same time, though, if we somehow extended ChaCha to use a gigabit key, there's no guarantee that a new attack would necessarily be thwarted by such a large key, either. So, I don't view excessively large keys as great "insurance" against future cryptanalytic attacks.


As an update for anyone curious, today (2015 July 04) was labeled as "internet independence day" in the linked video - supposedly the launch date of "Thundercloud." The Thundercloud website (warning: autoplaying video) has not been updated, and the Thundercloud Twitter account has gone dark, so at this point, the software probably classifies as vaporware.

$\endgroup$
3
  • 2
    $\begingroup$ Thank you for explaining this is such detail! I totally agree that home rolled encryption (security through obscurity) will not do this product any good. And, like you said, I felt it was very buzzword specific, without much on actual implementation. $\endgroup$
    – Tanner
    Commented Jan 30, 2015 at 1:06
  • $\begingroup$ Apparently the Thundercloud website has been sold to some unrelated cloud service. $\endgroup$
    – forest
    Commented Feb 25, 2018 at 3:55
  • $\begingroup$ Regarding the first point, I'm pretty sure writing it in Java would suffice. $\endgroup$
    – forest
    Commented Sep 21, 2018 at 2:21
5
$\begingroup$

Yes, he is full of crap.

If you go to KeyLength, you can compare key lengths for different cryptosystems and see how long they're expected to be secure for.

It's just a performance vs security tradeoff that implementers make. Most people don't see the point in schlepping around megabytes of key material for cryptosystems that are expected to be secure against quantum attacks and more advanced cryptanalysis, so they certainly don't see the point in schlepping around hundreds of megabytes of key material for a cryptosystem that we expect to see die in our lifetimes.

$\endgroup$
0
2
$\begingroup$

Big numbers must be better than small numbers right. That is the logic behind those kinds of claims.

The reality however is computing is limited to the laws of the physical universe. Setting quantum computing aside for now, the complexity of a problem can be translated into an energy cost. For classical computing that means that 128 bit is "beyond brute force" and 256 bit exceeds the available energy in our solar system.

Schneider goes into details in the link, but the short version is that if you captured all the energy of our star not for a day or year but until it burned out and used it to power a perfect computer (that is one operating at the thermodynamic limit) it could not count to 2^256 before it ran out of energy. https://www.schneier.com/blog/archives/2009/09/the_doghouse_cr.html

Now computers today have efficiency nowhere close to a perfect computer and we can't use energy on a stellar scale so that scenario is somewhat fantastical but it does show an upper limit of what classical computing can achieve.

These numbers have nothing to do with the technology of the devices; they are the maximums that thermodynamics will allow. And they strongly imply that brute-force attacks against 256-bit keys will be infeasible until computers are built from something other than matter and occupy something other than space.

Asymmetric encryption strength requires larger keys to achieve the same security because there are known attacks which are faster than an exhaustive search. RSA requires 15,380 bit keys and ECDSA requires 512 bit keys to have 256 bit security. For hashing algorithms the bit strength against collisions is half the length of the digest so a 512 bit hash is required for 256 bit security.

The laws of the physical universe mean that even keys of these modest sizes will never be brute forced. That is not to say they can never be broken. Flaws can be discovered in algorithms, and non classical computing (quantum computing, reversible computing) may someday require the development of newer algorithms but "1 billion bit" is simply snake oil at its best.

$\endgroup$
2
  • 1
    $\begingroup$ Actually a dyson sphere running grover's algorithm could brute force a $2^{256}$ keyspace because the algorithm cuts the effective keyspace of any cryptosystem to $2^{n/2}$. $\endgroup$
    – forest
    Commented Feb 25, 2018 at 3:56
  • 2
    $\begingroup$ @forest Note that this assumes a single sequential grover circuit running for time $2^{n/2}$. The advantage of grover drops as you limit the number of sequential steps. $\endgroup$ Commented Jul 21, 2018 at 8:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.