Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I wonder how much of the warehoused data[1] being sat on by security agencies will be decrypted in any meaningful timeframe.

[1]: E.g. the exabytes at https://en.wikipedia.org/wiki/Utah_Data_Center, but there's lots of these agencies in the world



Decrypting against leaked / found private keys is likely the path for now - but on the infinite timeline - 100% will be decryptable.


Once there is a tingle it’ll happen they’ll reissue keys and reencrypt. Nobody is going go “oh well out of business time was a good run”


But all the data up to that point is wide open. If it ever becomes practical to decrypt captured data, there's going to be some interesting leaks from non-quantum-proof encryption age.

Also lots of cryptocurrencies will shit themselves, which might be a feature or a bug, depending on your perspective.


You have to operate under the assumption that state agencies already have access to your communications. Also, 256 bit hashes are considered broken but that doesn’t mean state agencies can break the at a sufficient rate or that they are interested in breaking cryptocurrencies.


which well known 256 bit hash is broken?


Let’s assume you’re right and the crypto itself is sound. I agree that is likely and doubt any TLAs have a significant mathematical edge. Does the NSA just stop there and call it a day? No, of course they write Stuxnet. They attack everything else.

What well known piece of software isn’t broken?


FreeBSD?


I think you mean OpenBSD. From their homepage:

> Only two remote holes in the default install, in a heck of a long time!

FreeBSD, not so much.

https://www.cvedetails.com/vulnerability-list/vendor_id-6/pr...


Keep in mind that openbsd has a tiny base install, so it's not exactly surprising that there aren't a lot of remote exploits. Nothing's listening by default, so why would there be?

By the time you set up OpenBSD to do anything, that's gonna change.


Indeed. “Default install” is a big asterisk.


Up to 1024 bit is considered to be broken (not mathematically but at least by means of brute force) against state actors in a targeted attack.


What do you mean by "brute force"? Find a collision? I think it's almost certain the combined resources of every computer ever made would be unable to brute force a collision in a 1024 bit hash.


You're confusing symmetric and asymmetric cryptography, it's such a basic mistake that maybe you should not comment on cryptography until you've read some more.

SHA-256, SHA-3-256, BLAKE2, BLAKE3, etc. are all not-broken and have "128 bits of security".

256bit ECC like NISP P-256 ECDHE, ECDSA and ECIES, X25519 ECDHE and Ed25519 EdDSA are not-broken and have "128 bits of security".

RSA and FFDHE at 3072 bit are not broken and have about "128 bits of security". RSA-2048 remains very popular, although it is only about 112 bits of security.

See https://security.stackexchange.com/a/230713/70830 and the links from it for more info.


That does not sound right. Are you talking about RSA?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: