Recently, I've been reading a couple of papers about building cryptosystems that are secure for up to 30 years. But for some applications, this seems a bit low to me. So I am wondering if considering the current state of the art in cryptography and computing power evolution forecasts, one could instead build a public-key encryption system, running on today's consumer hardware, which is secure for any foreseeable future.
Of course, written like this, the problem is too broad, so my specific criteria are as follows:
- Keys are permanent, ciphertext which has been encrypted today must remain secure
- Security is broken if an attacker can reliably decipher text which has been encrypted with the public key, without possessing the private key
- Scenarios in which the attacker gets a hold of the private key by stealing, torture, and other means of extracting it from the rightful owner, are not considered a breach of security
- My (very generous) upper bound for performance forecast realism is 1000 years in the future
- I personally do not consider general-purpose quantum computers, based on logic gates operating on a large number of entangled qubits, to be viable in any foreseeable future, so security against them is just a nice extra
- More specialized quantum computing systems like D-wave's quantum annealing, however, which do not rely on many-particle entanglement, are within the realm of possibilities
- Attacker may be considered to have access to exabytes of ciphertext and terabytes of plain text - ciphertext pairs
- Attacker may have access to state-of-the-art computing power, like the supercomputers of his generation
- It must be possible to transfer public keys over the Internet within a reasonable time (absolute maximum is 1 day on a low-end 30 kB/s Internet connection -> 2GB), but they do not need to be transmitted frequently so it is acceptable if the keys are unusually big
- Encryption must be fast on today's hardware, let's say 30 MB/s on a high-end laptop as a lower performance bound
Is this totally crazy, or can it be done using today's knowledge in cryptographic algorithms + implementations which are either available today or can be made available in the near future?