Examining his claims about "Thundercloud": * You can use it with "any existing software, operating system, or device" (a massive amount of effort---by whom?) * Has its "own cryptographic language that is completely independent of any existing security technology" (this is a **negative** thing: abandoning the entire knowledge base of cryptography is incredibly stupid) * Its strength is "built within [its] proprietary design of the public and private cryptographic keys" (proprietary design is **not** a strength) * Those keys are 1 billion bits (125 megabytes!!!) * Those keys are "rotated randomly every 5 seconds" (a generation rate of 200 megabits per second) * Those keys are "controlled entirely by the user" (how they can generate 200 megabits per second is beyond me) * "No information is ever stored... besides of our standard encryption keys in excess of a terabyte data block" (???) * However, the above is what makes their technology so exciting---since it's transferred in the space of 200 kilobytes! (what?) * Will conform to *any* existing method of data storage or communication *without any overhead* * "Most security keys range from 128-bit to 4096-bit" (I guess the range includes both symmetric *and* asymmetric encryption!) * Since "most" security keys are so small, "cracking security keys in this size is fairly easy with enough computational power" (of course this is true---by definition, "enough" computational power will break computational security; that's kind of the point) * Current cryptographic technology is no longer safe: even RSA crypto was discovered to have "back doors" (yes, recently a blog post circulated showing that RSA can be backdoored if you let someone else control key generation, but that is practically a non-issue) * The system is designed from the ground-up to be *impossible to breach* * Every supercomputer in the world in tandem can't break it! (Neither can they break ChaCha20 with its 256-bit key, though, either......) * Adding tracking elements to Thundercloud is "technically impossible" Needless to say, I am very skeptical. He certainly uses many technical terms, but there's very little substance. Sporting massive key sizes are a telltale sign of bullshit. Answering your question directly: [128-bit encryption is generally considered very sufficient](http://security.stackexchange.com/a/6149/1373). Maybe it is not very sufficient: then you can pick 256-bit, [whose breaking by exhaustive search is "totally out of the reach of mankind"](http://crypto.stackexchange.com/a/1148/2454). If exhaustive search of a 256-bit keyspace is totally out of the reach of mankind, why should you use 1 billion bit keys? Even if you built a system that could, is the massive overhead of trying to use a 1-billion-bit key really worth it? I wouldn't say so: not when 256-bit keys suffice. Some schemes can be broken *much* faster than by doing an exhaustive search. For example, to get "256 bits of security," [you need 15360 bits for RSA](http://crypto.stackexchange.com/a/8692/2454), so there's an example of needing a really, really, really large key to attain a certain security level. (Also, notice that I'm saying 15Kbits is really, really, really large. Imagine how I must feel about a gigabit!) (Almost?) all practical cryptosystems might be broken in the near future, so we can't say that 256-bit encryption with, say, ChaCha20 gives you ironclad, unstoppable security. At the same time, though, if we somehow extended ChaCha to use a gigabit key, there's no guarantee that a new attack would necessarily be thwarted by such a large key, either. So, I don't view excessively large keys as great "insurance" against future cryptanalytic attacks.