Skip to main content
5 of 5
replaced http://crypto.stackexchange.com/ with https://crypto.stackexchange.com/

Examining his claims about "Thundercloud":

  • You can use it with "any existing software, operating system, or device" (a massive amount of effort---by whom?)
  • Has its "own cryptographic language that is completely independent of any existing security technology" (this is a negative thing: abandoning the entire knowledge base of cryptography is incredibly stupid)
  • Its strength is "built within [its] proprietary design of the public and private cryptographic keys" (proprietary design is not a strength)
  • Those keys are 1 billion bits (125 megabytes!!!)
  • Those keys are "rotated randomly every 5 seconds" (a generation rate of 200 megabits per second)
  • Those keys are "controlled entirely by the user" (how they can generate 200 megabits per second is beyond me)
  • "No information is ever stored... the size of our standard encryption key is in excess of a terabyte data block" (???)
  • However, the above is what makes their technology so exciting---since it's transferred in the space of 200 kilobytes! (what?)
  • Will conform to any existing method of data storage or communication without any overhead
  • "Most security keys range from 128-bit to 4096-bit" (I guess the range includes both symmetric and asymmetric encryption!)
  • Since "most" security keys are so small, "cracking security keys in this size is fairly easy with enough computational power" (of course this is true---by definition, "enough" computational power will break computational security; that's kind of the point)
  • Current cryptographic technology is no longer safe: even RSA crypto was discovered to have "back doors" (yes, recently a blog post circulated showing that RSA can be backdoored if you let someone else control key generation, but that is practically a non-issue)
  • The system is designed from the ground-up to be impossible to breach
  • Every supercomputer in the world in tandem can't break it! (Neither can they break ChaCha20 with its 256-bit key, though, either......)
  • Adding tracking elements to Thundercloud is "technically impossible"

Needless to say, I am very skeptical. He certainly uses many technical terms, but there's very little substance. Sporting massive key sizes are a telltale sign of bullshit.

Answering your question directly: 128-bit encryption is generally considered very sufficient. Maybe it is not very sufficient: then you can pick 256-bit, whose breaking by exhaustive search is "totally out of reach of Mankind".

If exhaustive search of a 256-bit keyspace is totally out of reach of Mankind, why should you use 1 billion bit keys? Even if you built a system that could, is the massive overhead of trying to use a 1-billion-bit key really worth it? I wouldn't say so: not when 256-bit keys suffice.

Some schemes can be broken much faster than by doing an exhaustive search. For example, to get "256 bits of security," you need 15360 bits for RSA, so there's an example of needing a really, really, really large key to attain a certain security level. (Also, notice that I'm saying 15Kbits is really, really, really large. Imagine how I must feel about a gigabit!)

(Almost?) all practical cryptosystems might be broken in the near future, so we can't say that 256-bit encryption with, say, ChaCha20 gives you ironclad, unstoppable security. At the same time, though, if we somehow extended ChaCha to use a gigabit key, there's no guarantee that a new attack would necessarily be thwarted by such a large key, either. So, I don't view excessively large keys as great "insurance" against future cryptanalytic attacks.


As an update for anyone curious, today (2015 July 04) was labeled as "internet independence day" in the linked video - supposedly the launch date of "Thundercloud." The Thundercloud website (warning: autoplaying video) has not been updated, and the Thundercloud Twitter account has gone dark, so at this point, the software probably classifies as vaporware.

Reid
  • 6.9k
  • 1
  • 40
  • 58