This is a basic question in cryptography but I have not found a good, comprehensive answer.

It is explained that our keys should expire and we should get new, stronger ones with time, reflecting more powerful decryption computing. Does that mean that emails encrypted today will become easier (even trivial) to decrypt in future, so emails encrypted today will eventually lose today's privacy?

If so, what is the general opinion on how this affects notions of privacy by encryption?

  • $\begingroup$ For modern algorithms with appropriate key lengths: until the algorithm is broken, the implementation is broken, the context you use it in is broken, the key is disclosed to a third party, or quantum computers become generally available (for current asymmetric algorithms, and for symmetric algorithms with key sizes smaller than 256). $\endgroup$ Jan 27, 2014 at 6:48

5 Answers 5


@fgrieu has written a good answer but there's slightly more to be said on the topic.

It is entirely possible that a paper will someday be published that shows a practical attack on 2048-bit RSA. Equally, a new attack could be discovered that breaks AES in a reasonable amount of time. Finally, someone might find a collision in SHA-256!

This has happened before. When differential and linear cryptanalysis were discovered many designs fell to these attacks. Factoring algorithms have got faster over time, etc etc. A collision was recently found in MD5 and soon after there were tools that could do this in next to no time.

As @fgrieu pointed out, having planned obsolescence gives you opportunity to repair the fence: increase key-size, remove bad algorithms, introduce new algorithms etc etc.

That sad, there are no proofs of (absolute!) security for any of our primitives. Their security is based on the fact that everybody who has looked at these primitives has failed to break them.

Given this, it is difficult to know how long a ciphertext created today with AES-128 will remain secure.

On the one hand, it could well be "forever" and on the other hand a clever grad student somewhere might find a break on AES-128 in $2^{40}$ time tomorrow.

We just don't know.

  • 4
    $\begingroup$ Right. But that's mostly a reason to change algorithm, not key or key size (as asked in the question). And I can't recall a devastating cryptanalytic attack (as opposed to attacks on implementations) striking a widely deployed cryptographic algorithm in the last 30 years (if we discount attacks on keys that where deliberately shortened, like DES; and of course attacks on passwords). $\endgroup$
    – fgrieu
    Jan 26, 2014 at 21:21
  • 1
    $\begingroup$ Wait, isn't BitCoin based on people finding collisions in SHA-256? $\endgroup$ Jan 27, 2014 at 0:32
  • 2
    $\begingroup$ @AJMansfield No, only partial preimages afaik, such as "the first X bits of the hash must match this bitstring", which cannot be done efficiently as far as we know, hence the proof-of-work aspect of it (collisions do not matter for that part of bitcoin I believe). If a fast preimage attack on SHA-256 were discovered, bitcoin would be utterly broken, which is why it (or at least the proof of work part of it) has planned obsolescence in a few years were all blocks will have been mined - hopefully before SHA-256 is broken enough to matter. $\endgroup$
    – Thomas
    Jan 27, 2014 at 1:49
  • $\begingroup$ @Thomas: Bitcoin is still supposed to work past the data where no new coins can be minted. Miners are supposed to make their money through transaction fees in those days. $\endgroup$
    – Christian
    Jan 27, 2014 at 1:54
  • 2
    $\begingroup$ I think you've overreached @fgrieu. MD5 and A5/1 must surely qualify under you criterion? I'd even put RC4 in that bucket. $\endgroup$ Jan 27, 2014 at 7:27

The main good reasons to change keys periodically are:

  • to mitigate the risk of a key compromise; at least some ways keys get compromised are a one-time event, e.g. eavesdropping of the keyboard protecting the passphrase; changing the key thus restores security until the next leak, and only messages enciphered with the leaked key are compromised (and only those actively intercepted after the leak if the scheme provides forward secrecy)
  • so that humans remember the procedure;
  • addition per comment: in order to reduce the risk coming from using the same key of a block cipher for too many blocks; e.g. for 3DES in CBC mode: if the adversary has 32 GiB of known plaintext (e.g. all-zeroes of an idle link), chances that she can decipher 8 meaningful bytes from another 32 GiB worth of data are >63%.

The main reason to increase key size (which is, or at least should be exceptional compared to key change) is to induce retirement of the obsolete tools used to process the keys; not only is it business to security vendors, it often is the best way to increase security; for examples, if 1024-bit keys are deemed no longer usable, chances are that the Smart Card holding them will be replaced by newer ones, designed with better side-channel leakage protection. In my experience, resistance against brute force is rarely the real weak point in a commercial application (except if that was engineered-in, e.g. to meet some legal requirement).

  • 1
    $\begingroup$ Good answer. I think one important reason is the acceptable amount of use for a key. Especially algorithm with short block (like 3DES) in practice has to be changed because of this. $\endgroup$
    – user4982
    Jan 26, 2014 at 19:48
  • $\begingroup$ @user4982: good point! I added it to the answer. $\endgroup$
    – fgrieu
    Jan 26, 2014 at 21:16

The key can be found using brute force, this will take some time and answers provided earlier are valid.

However there are other means to discover a key immediately in a specific context, without using lengthy brute force attacks.

I like this one based on sound emitted by the computer when dealing with encryption, : and this one using the time required to compute encryption keys.

These techniques don't try to discover the unknown key using multiple key values, but just observe how the computer works when processing the actual key.

When specific conditions are met, the strongest key can be discovered within second split unless the existing hardware is redesigned to prevent the methods to work and compromised hardware is removed from use. Note that increasing the key length only is not effective.

Your question about email privacy should be understood as excluding such specific conditions.


Are we still thinking the same as to the question of when clever grad student find a break except that now the forever part is off the table and its just a simple how much longer until parrot bots take it all and buy themselves an ice cream cone. It would be really nice to get the consensus of everyone that was here 9 years ago.


How long will my encryption remain private → For ever and ever and ever, waaay past the death of the Universe if you used a one time pad. And that’s the point They don’t want you to know.

No correctly implemented one time pad (OTP) has ever been broken, because they’re mathematically proven to be unbreakable, even within the eras of post quantum & dilithium computing.

You’re not around these days, but your ideas and cipher texts might be. Because you were lied to, just as we’re being lied to today. OTPs work. However tricky OTPs are, every one in the real world uses them. I won’t reiterate all the benefits of OTPs now; rather just point our dear readers to this list and tell them to warm up their soldering irons and hammers.

No other human endeavour puts all of its eggs into one AES basket, other than NSA cryptographers, their puppets and suspiciously pro state actors on this forum. Our good friends at Fort Meade may have broken all mainstream encryption and made decryption trivial.

But not if your email was encrypted with a OTP. Therein lies your privacy.

  • $\begingroup$ I think the answer might benefit from focusing on the facts (e.g. the unconditional security of OTPs), rather than calling previous answers and contributors "lies" and "suspicious pro-state actors" respectively. $\endgroup$
    – Morrolan
    Aug 6, 2023 at 9:42
  • $\begingroup$ @Morrolan Your problem with ‘facts’ is that they’re pretty much esoteric , irrelevant and down right deceitful. Children can make up ‘facts’. Witness the heinous attacks upon President Trump. And the ecoterrorist ‘fact’ of global warming. Only His Truth matters. As in the Truth of Jesus’s love for you and His sacrifice for the Righteous. So if you believe in the ”unconditional security of OTPs” , as we do, why do our moderators ban discussion of them and sabotage OTP Hot Network Questions? Fact or Truth? It seems unholy. $\endgroup$
    – Paul Uszak
    Aug 6, 2023 at 23:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.