The goal of the Tahoe-LAFS 100 Year Cryptography project is to "enhance Tahoe-LAFS's cryptographic system so that Tahoe shipped today/next year might remain safe from cryptographic attacks for a 100 years." Its developers are openly collaborating knowledgeable experts in the field, with at least all the information on the internet today at their disposal.

How long would such a project have secured its data had it been started 100 years ago?

Is the length of the secure period monotonically increasing as we ask the question with starting points less distant in the past?

up vote 18 down vote accepted

In 1911, there was no computer either. With much more modest goals of security for the next few months, the German army came up with the Enigma, which was broken. Before the 1970s, cryptography was essentially a military-only domain, so there were no "openly collaborating knowledgeable experts". The situation was qualitatively different. So it is a bit unfair, and of limited scientific value, to try to compare cryptographic systems before and after the seventies.

Moore's law was published by Gordon Moore in 1965, and thus was quite well known 10 years later. In 1976, people trying to build a system which would still be safe 100 years later would have accounted for Moore's law, meaning an extra 100 bits for symmetric keys, and 200 bits for hash functions (there are several variants of Moore's law, but one of the most optimistic says that every two years you can put twice as many transistors on a given die and clock them twice faster, leading to a doubling of CPU power every year). Symmetric encryption was beginning to be understood; DES had just been approved as a US standard, so, presumably, people aiming for 100-year security would have proposed something like 5-DES. They might have missed the point about block size: DES has 64-bit blocks, making it unsuitable for securely encrypting more than a few dozen gigabytes with a given key. Even if believing Moore's law, the sheer volume of today's data was not envisioned at that time.

In 1976, there was no hash function worth speaking of. The Merkle-Damgård construction was published in 1978. Even MD2 did not appear until 1989.

Digital signatures may have been a problem. In 1976 there was no efficient digital signature system. When RSA was published in 1978, the article contained an overly optimistic comment about how a 512-bit integer would resist attacks for millions of years (this became breakable in 1999). Also, appropriate padding techniques were not developed until the early 1990s.

So a "100-year cryptographic system" developed in 1976 would have been partially broken by now; but some parts would have kept well (probably symmetric encryption). Also, the system would have become inadequate for our evolving needs, in the same way that even a very fast Enigma machine would still encrypt characters out of a very small set (only letters, no space and no digits !), making it unsuitable for encrypting bytes.

This shows that we tend to get wrong ideas about what the future will hold (we are in 2011, where is my flying car ?). In particular, we do not understand what we will need 40 years from now, and we have relatively little grasp of the threats that will appear at that time. Right now, the trendy fearsome threat is the Quantum Computer.

(This is all an intricate way of saying that your question cannot be answered.)

  • 2
    The enigma was broken because of failure to follow protocol. Had they germans followed the protocols that were put in place we probably never break it. But we were allowed to capture a sub with one intact along with a manual. Then later a second. – Chad Aug 18 '11 at 20:43
  • For a question that cannot be answered, I found that to be a pretty interesting answer. :-) It was intended to be a bit ambitious and open-ended. – Marsh Ray Aug 18 '11 at 21:15
  • 1
    The point about things being qualitatively different back when crypto was all military secrets is well-taken. Nevertheless, world-class experts were certainly collaborating in teams within the scope of their own secrecy, which could still be quite impressive. (Bletchley Park cf. Eurocrypt 2011 anyone?) Collaboration in a restricted scope certainly has disadvantages, but being well-funded and focused has its own advantages too. Is it any more unfair of a question to them than to those attempting such a project today? Maybe, perhaps. – Marsh Ray Aug 18 '11 at 21:22
  • +1 I like this post a lot. 100 years ago they where basically cave men pounding two rocks together, and in 100 years we'll be viewed in the same way. – Rook Aug 21 '11 at 18:45
  • 1
    @Chad Yeah but that wouldn't have been a problem if we didn't have Alan Turing on our side. – Rook Aug 21 '11 at 18:46

It really depends on how you define the problem. The One-Time-Pad was invented in 1882, so a well designed storage scheme using a OTP would probably still be secure today.

The Vigenère cipher is basically a OTP that uses a caesar shift over the letter determined by some key. In practice these keys were often letters or rare books. A small subset of messages encoded with the Vigenère cipher has yet to be broken despite rigorous modern efforts.

The problem is that people didn't think about cryptography then the way they do now.

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.