Can I still use insecure curves/ciphers for time relevant encryption?

Question

Can Ciphers that are known to be insecure because their keysize is considered too small still be used in appliances that have a tight decryption timeframe? In particular I am looking at ECC2K-130.

ecc-challenge.info states, that they need 2466 PlayStation 3's to carry out the required 2^60.9 iterations per year.

Let's assume I need to encrypt data only for one minute, after that time the data is useless. Couldn't I still use ECC2K-130 as it would require 525600 times more PlayStations to crack it in a single minute instead of a year?

Or do I have a misunderstanding in the way this works?

Answer 1

Let's assume I need to encrypt data only for one minute, after that time the data is useless. Couldn't I still use ECC2K-130 as it would require 525600 times more PlayStations to crack it in a single minute instead of a year?

!!! NO !!!

Decryption by an unauthorized party could occur within a fraction of a second following the release of the ciphertext.

In ECC encryption (and more generally public-key encryption), the appropriate start time for the attack interval is

1. NOT the release of the ciphertext to adversaries
2. NOT the encryption time (even if there's a side channel¹)
3. is the release of the public key used for encryption to adversaries²
4. could be the generation of the public/private key, if there's a side channel¹.

At issue is that attackers can start working long before the encryption occurs or the data to encrypt even exists. They can start as soon as they get the public key (or, in 4, side channel data). That's when time of attack starts ticking. It is reset only by a key change.

In the question, the entity making the encryption uses the public key, thus is not the one who generated the keypair. The question suggests that the time considered is from encryption to when knowing the data becomes dull, which would be 2 in the above.

---

¹ In side-channel attacks, adversaries get information beyond the ciphertext in often unexpected ways, like timing of encryption, electromagnetic or acoustic emissions, leakage from a CPU process to another.

² In symmetric cryptography, that would be when the first ciphertext is obtained by adversaries.

Answer 2

I would go further than fgrieu and say that in general you should not use (significantly) weakened cryptographic primitives for only time sensitive crypto, regardless of the time window.

Why?

Because there is nothing that guarantees hardness of any crypto. Mathematically the status quo is that we are generally have nothing more than 'a bunch of smart and knowledgeable people have tried to break it using various methods and were unsuccessful' to label something as 'secure'.

That is, there is (almost entirely) no 'well at least it's this secure' in crypto. It's always 'we've only broken it so far'. There is no floor of minimum security provided.

Knowing that, I would be really skeptical of any method where our very shallow guarantee of 'we've tried to break it and failed' has already degraded to 'we've tried to break it and the cracks are showing'. A complete break could be around the corner tomorrow.