Internetworkers: http://www.ibiblio.org/internetworkers/

["Shea Tisdale" <shea AT sheatisdale.com>]

Tom I know you will be exchanging messages and file of great importance, so
I recommend that you use a 4096 bit key and then re-encrypt the results with
a second program using something like the blowfish algorithm.  :-)

On a more serious note, as has been previously mentioned on this list, a
cipher (or encryption method) is secure and thus worthy of use if the
information contained within the message is no longer valuable by the time
the encryption can be cracked.  

I prefer using long key lengths like 2048 or 4096.  I've never had any
reason to need it, but what the heck.  It encrypts it fast enough for me
with those enormous key lengths...and who knows why, but you never can tell
what the NSA or someone might want to read...

With that said, consider how long it has taken to break a modern encryption
method.  RC5 is a modern encryption method by RSA labs that is considered on
par with idea, blowfish and others.

RSA sponsored a brute force attack on the government recommended standard
(DES) and on their own RC5 method and the following are the results.  Notice
that with a good method like RC5, short key lengths took enormous amounts of
time using massive computational power as shown below:

DES                     22 hours 15 minutes     (government recommended
method)
RC5 40bit key   3.5 hours
RC5 48bit key   313 hours
RC5 56bit key   250 days
RC5 64bit key   1757 days
RC5 72bit key   unbroken

During the RSA contest, the peak key rate for the RC5 64bit attack was
270,147,024 kkeys/second.  At that pace, it would have taken 770 days.  To
equate that key rate to common computer power, it would take 32,504 800 Mhz
Apple Powerbook g4 laptops or 45,998 AMD Athlon XP machines running at 2ghz
to sustain that rate.  Based on the Athlon processor, that is approximately
211,820,790 mips or 106,225,380 mflops (106.23 Tflops) of power. 

The fastest supercomputer in the world is the Earth Simulator.  It is rated
at 35.86 TFlops.  Even with that enormous capability, that is only 1/3 the
speed required to crack RC5 64bit in 770 days.



> -----Original Message-----
> From: internetworkers-bounces AT lists.ibiblio.org [mailto:internetworkers-
> bounces AT lists.ibiblio.org] On Behalf Of Thomas
> Sent: Monday, July 26, 2004 8:29 PM
> To: Internetworkers: http://www.ibiblio.org/internetworkers/
> Subject: [internetworkers] crypto
> 
>       I am finally getting around to something that's been on my list for
> a
> long time:  setting up encryption capability on my computer.  I've
> installed GnuPG and the Enigmail plug-in for Mozilla.  I generated a set
> of keys on a trial run, everything seems to be working as it should.
> Seems like the end user applications have improved significantly during
> my period of procrastination.
> 
>       One question I am mulling over is that of appropriate key size.  I
> wonder if the cryptophiles here could shed a little wisdom on the
> subject.  What's the conventional wisdom these days on key size?  1024?
>   2048?  1536?
> 
>       I found an article on the subject that seems helpful, advocating a
> 2560-bit key.
> http://www.arraydev.com/commerce/jibc/9605-4.htm
> It was written in 1996.  The basic logic seems sound.  Has anything
> changed in eight years to change that?
> 
>       Thanks in advance for your comments.  This has been a phun project
> and
> I've enjoyed learning more about practical cryptography.
> 
> TaB
> 
> P.S.  Anybody up for a key-signing session at next week's Gathering at
> the Hibernian?
> ---
> Come and play at the InterNetWorkers Web site!
> http://www.ibiblio.org/internetworkers/
> You are currently subscribed to InterNetWorkers mailing list
> To unsubscribe visit
> http://lists.ibiblio.org/mailman/listinfo/internetworkers