Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
This is a basic question in cryptography but I have not found a good, comprehensive answer.
It is explained that our keys should expire and we should get new, stronger ones with time, reflecting more powerful decryption computing. Does that mean that emails encrypted today will become easier (even trivial) to decrypt in future, so emails encrypted today will eventually lose today's privacy?
If so, what is the general opinion on how this affects notions of privacy by encryption?
@fgrieu has written a good answer but there's slightly more to be said on the topic.
It is entirely possible that a paper will someday be published that shows a practical attack on 2048-bit RSA. Equally, a new attack could be discovered that breaks AES in a reasonable amount of time. Finally, someone might find a collision in SHA-256!
This has happened before. When differential and linear cryptanalysis were discovered many designs fell to these attacks. Factoring algorithms have got faster over time, etc etc. A collision was recently found in MD5 and soon after there were tools that could do this in next to no time.
As @fgrieu pointed out, having planned obsolescence gives you opportunity to repair the fence: increase key-size, remove bad algorithms, introduce new algorithms etc etc.
That sad, there are no proofs of (absolute!) security for any of our primitives. Their security is based on the fact that everybody who has looked at these primitives has failed to break them.
Given this, it is difficult to know how long a ciphertext created today with AES-128 will remain secure.
On the one hand, it could well be "forever" and on the other hand a clever grad student somewhere might find a break on AES-128 in $2^{40}$ time tomorrow.
We just don't know.
The main good reasons to change keys periodically are:
The main reason to increase key size (which is, or at least should be exceptional compared to key change) is to induce retirement of the obsolete tools used to process the keys; not only is it business to security vendors, it often is the best way to increase security; for examples, if 1024-bit keys are deemed no longer usable, chances are that the Smart Card holding them will be replaced by newer ones, designed with better side-channel leakage protection. In my experience, resistance against brute force is rarely the real weak point in a commercial application (except if that was engineered-in, e.g. to meet some legal requirement).
The key can be found using brute force, this will take some time and answers provided earlier are valid.
However there are other means to discover a key immediately in a specific context, without using lengthy brute force attacks.
I like this one based on sound emitted by the computer when dealing with encryption, : and this one using the time required to compute encryption keys.
These techniques don't try to discover the unknown key using multiple key values, but just observe how the computer works when processing the actual key.
When specific conditions are met, the strongest key can be discovered within second split unless the existing hardware is redesigned to prevent the methods to work and compromised hardware is removed from use. Note that increasing the key length only is not effective.
Your question about email privacy should be understood as excluding such specific conditions.
Are we still thinking the same as to the question of when clever grad student find a break except that now the forever part is off the table and its just a simple how much longer until parrot bots take it all and buy themselves an ice cream cone. It would be really nice to get the consensus of everyone that was here 9 years ago.
How long will my encryption remain private → For ever and ever and ever, waaay past the death of the Universe if you used a one time pad. And that’s the point They don’t want you to know.
No correctly implemented one time pad (OTP) has ever been broken, because they’re mathematically proven to be unbreakable, even within the eras of post quantum & dilithium computing.
You’re not around these days, but your ideas and cipher texts might be. Because you were lied to, just as we’re being lied to today. OTPs work. However tricky OTPs are, every one in the real world uses them. I won’t reiterate all the benefits of OTPs now; rather just point our dear readers to this list and tell them to warm up their soldering irons and hammers.
No other human endeavour puts all of its eggs into one AES basket, other than NSA cryptographers, their puppets and suspiciously pro state actors on this forum. Our good friends at Fort Meade may have broken all mainstream encryption and made decryption trivial.
But not if your email was encrypted with a OTP. Therein lies your privacy.
