Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am trying to increase my understanding of data encryption, and I was wondering this. It would be really nice if there were any good tools to test how secure my encrypted data is, for example how long it would take for an average rotten apple spoiling the barrel to decrypt it.

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Existence of a tool that can guarantee security of some encryption system would entail proving a number of hard scientific problems, up to and including the famous P vs NP. Right now, no cryptographer has succeeded in proving that secure encryption or hashing can actually exist, let alone designed a tool that could test a given system. All we have are candidates: not functions that cannot be broken, just functions that we don't know how to break, though we have tried hard.

What can exist is a tool that runs some statistical analyses on, say, the output of a purportedly secure PRNG, and declare whether some bias appears. If a statistical analysis tool finds a bias, then it is obvious that the cryptographic algorithm is pure junk. However, if it does not, then it does not prove anything one way or another. Almost any algorithm, weak or not, produces outputs in which statistical analyses systems won't see anything obviously fishy.

The practical way to assess the security of an encryption system is:

  1. Is the method documented (precisely, down to the bit level, enough to potentially write an interoperable new implementation) ? If not, then it is probably not secure.

  2. Has that documentation been published as a protocol for inspection by cryptographers for at least two years ? If not, then you cannot know if it is secure.

  3. Has the implementation good repute, do developers publish known security issues and produce fixes promptly ? If not, then don't use that tool.

share|improve this answer
    
Very detailed answer. Thank you. Thank you as well, Desthro. –  Thierry Nov 7 at 11:05

I think your real question is at the end there, "How long is it going to take to break my encryption?" And that tool that you are asking about is mathematics.

For symmetric-key ciphers, you can calculate the number of possible keys by using 2^x where x is the number of bits in your key. In AES-256 for example, the key is 256 bits long, which gives us 2^256 possible keys, it's bordering close to 10^77 possibilities. Then, you can take the number of guesses that can be performed per second, say, 1,000,000,000 (somewhat feasible), and you divide them up with some mathematics, and learn that on average it'll take about 10^67 seconds to "brute force" a key like that. Even with 1,000,000,000,000,000 tries/sec (a quadrillion tries/sec), it' still 10^61, which is longer than the universe has existed... still...

There are some weaknesses in AES that reduce the problem size, so instead of taking 10^67 seconds it's a little less, like 10^60 seconds, but that's still an impossibly long period of time. Other cryptosystems have varying key strengths, so you'll have to calculate the time-to-crack yourself for each of them, but generally speaking they are pretty similar.

Well-documented ciphers are "safer" in that their weaknesses are well-known, and you can find information on them pretty easily. Happy ciphers!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.