Skip to main content
1 of 2
Cort Ammon
  • 3.3k
  • 16
  • 20

We don't ever know, in the information theory sense, that a crypto algorithm wont fail suddenly. If we ever knew that, we'd quit using it. However, it has been shown that crypto algorithm failing has a strong tendency to fail according to a two step process:

  • Most crypto algorithms fail quickly in the initial analysis phase, as we apply a pile of known crypto-breaking tools to the problem, along with gobs of expert opinion.
  • The remaining algorithms have been shown to generally fall in phases. Attacks usually weaken the algorithm before finally breaking it. This is often measured in terms of bits. If a brute force attack would take 2^64 operations, and someone found a technique that takes 2^58 operations, then we say it has been weakened by 6 bits.

The latter is a perfect case for quoting "past performance does not predict future results." There is no guarantee that any future algorithm wont break at any unknown point in time. As a hedge against this, most modern crypto algorithms are designed in multiple rounds using one of the well known structures like a feistel network. We generally understand how to make feistel networks which fall gracefully, and those which do not have well-understood mechanics are often regarded with suspicion for many many years. As a result, there is a tendency (not a guarantee) for measuring weakness in bits to be a reasonable indicator.

Perhaps a better question would be "how bad is it if your current crypto algorithm fails overnight?" If you can put a dollar figure to that, you can at least try to apply Bayesian statistics to put in place rational safeguards against this possibility.

Cort Ammon
  • 3.3k
  • 16
  • 20