On Mon, May 22, 2006 at 10:11:11PM +0100, Jonathan McDowell wrote:
On Sun, May 21, 2006 at 04:27:49PM -0500, chrisisbd@leary.csoft.net wrote:
Why is it that *everything* uses some sort of public-key encryption algorithm for storing sensitive data? It's stupid!
OK, it's brilliantly useful for sending data across the internet and so on but for storing one's own sensitive data it is entirely pointless as far as I can see.
For example if I want to store a file with some sensitive data in it and only only want to be able to decrypt it myself then surely anything *but* a public key encryption algorithm makes sense. Essentially a public key algorithm means that there is always a brute force way of getting at the data, it may take more computing power/time than is available but it is in principle possible. Other ways of encrypting can be made essentially uncrackable if you want.
Are there any encryption experts here who can persuade me that I'm being silly?
The only thing that's provably secure is a one time pad. Even a symmetric key algorithm can be brute forced. The key is to ensure that the algorithm and key length you choose is not feasibly brute forceable before universe heat death.
You can *only* brute force surely if you know a significant chunk of the result of decrypting the data before you start, otherwise how does the brute force approach know when it's got a hit?