Calculating amount of time for brute forcing ciphertext depending on the size of the key

Question

I am a graphic design student and for my information graphic project I have chosen the topic of the history of encryption and how the security level developed over the centuries. It’s basically an information graphic to make people like me aware of encryption and its importance in times like these (see: news about the NSA et al.).

So I'm taking several encryption concepts like the Caesar cipher, the Jefferson Wheel and something more modern like AES to calculate the Brute-Force time of the maximum key size. The main point is that I want to show that the security level grew enormously and in which size they grew.

Now the problem:

I wanted to calculate the key size, so I did research on the key sizes of each specific encryption concepts. In addition to that, I wanted to calculate the brute force time of an attack for each encryption (to find out how long it takes to crack the individual encryption). I know, that is a simple approach but I wanted to keep it simple as possible.

Now I’m not sure if I calculated it correctly and I would really appreciate it if someone could explain what I did not understand about that.

For example:

The brute-force computer I found (www.orange.co.jp/~masaki/rc572/ratej.php) was 2096204400 keys/sec and it is set up like 1 brute-force PC vs. an PC which is using this specific encryption.

Everything was calculated with wolframalpha.com

• Caesar Cipher

  It got 25 possible combinations of characters (Wikipedia says its about 5bit) so that means the time 25/2096204400 seconds = 11.93 ns

• Enigma

  Wikipedia says it’s roughly about 77Bit long, so the possible keys are 20651321783174268000000 and 206651321783174268000000 keys/2096204400 (keys/s) = 3.124×10^6 average Gregorian years.

Are my calculations correct?

Answer 1

Your approach is too simple to give an accurate rating of the cryptographic systems. For any system that does not inherently suffer from short key lengths it is first and foremost its resistance to cryptanalysis that makes or breaks it.

The Vigenère cipher for instance is hundreds of years old and can easily be used with a very long key if so desired. That however does not prevent it from being a very poor algorithm by modern standards. It leaks so much information that if you know what to look for and have a decent length of message to work with you don't even need a computer to break it.

There can be no single way to compare wildly different cryptographic schemes, the very nature of their weaknesses differ. The best thing you can do is to list the requirements for breaking a given scheme, like:

Vigenère cipher:

• A guess about the contents and words likely used in the message.
• One or more messages using the same key, combined at least around double the length of the key.
• A person who is reasonably good at performing basic algebra.
• Some hours of that person's time.

Or:

• One or more messages using the same key, combined at least around double the length of the key.
• A person who understand and can use pattern frequency analysis of the language in which the message is composed.
• Some days of that person's time.