Talk:40-bit encryption

Keysize

Feel free to correct me if I'm wrong, but isn't DES in reality a 40-bit encryption standard? I know it actually has 56 bits, but my understanding was that for various reasons it really only offered 40 bits of encryption, and so is generally referred to as a 40 bit encryption method? Even the version of this page prior to my edit cited Deep Crack as being able to break 40 bit encryption rediculously fast (though I think it was very wrong on the time taken), and again, my understanding was that Deep Crack was built for DES and nothing else, so why was it referred to in an article on 40 bit encryption?

Deep Crack is the only dedicated brute force machine built for key search that we have the details about; I think the reason the machine is mentioned is that, when considering a key-size, it's useful to consider how well Deep Crack would perform given keys of that length. The machine was designed to be able attack up to the full 56 bits of DES. As a standard, DES accepts a 64-bit key; however, 8 bits are discarded as "parity bits" (well, that's the explanation given, anyway!), leaving 56 bits, the number usually quoted. Have a look at the references at the end of DES if you'd like to check up on this. There are theoretical attacks on DES that take an amount of time equivalent to brute forcing around 39-43 bits, but these aren't practical in any real-world-security sense. — Matt 13:50, 17 Sep 2004 (UTC)

Ah, yes, looks like I was mistaken, DES is 56 bit encryption out of a 64 bit key, not 40 out of 56 like I somehow mistakenly thought. I'd checked the Deep Crack entry before submitting, but didn't think to double check DES. Oh well, looks like 40 bit encryption really is as rediculously weak as was stated.

Yeah, it's pretty bad! If Deep Crack takes an average of 4.5 days to break a 56-bit key, then 40-bits would take less than 6.0 seconds by my calculation...— Matt 14:16, 17 Sep 2004 (UTC)

Deep Crack

I won't get into a revert war, but I have to mention how stupid it would be to build something like Deep Crack to brute force 40 bits (it's an FPGA so the DES Deep Crack can't be easily reused). It's the proverbial hammer and nut. Far from showing how weak 40 bits is, it gives the uninformed reader the impression that expensive hardware is needed to break it quickly. A farm of COTS can probably do it in an hour for a couple thousand bucks, and you don't really need to be any faster than that unless you're in a bad, bad John Travolta movie. Arvindn 16:54, 3 January 2007 (UTC)

Good work rewriting the 128 bit stuff BTW. Arvindn 17:01, 3 January 2007 (UTC)

Out of date information

The information about how long it takes to break a key on typical hardware available at the time is time-sensitive and constantly changing (by a factor of 2 every 18-24 months, if Moore's law is anything to go by). Therefore quoting any time value is very time-sensitive and doesn't make sense outside of the context of what year we are referring to. I suspect it may be out of date. In particularly, the sentence "On a typical home computer, a 40-bit key can be broken in a little under two weeks, testing a million keys per second" appears dated. If this fact comes from a few years ago, then the timeframe my be reduced to just a day or two by now, and in a few more years may be a matter of hours. mmj (talk) 05:22, 31 October 2008 (UTC)

I've edited it to make it less time-sensitive, though it could still benefit from a more recent source. For instance, something that says "It was found that a 40-bit key can now be broken in X hours by X computer (ie Intel Core 2 Quad @ 3.2GHz)" mmj (talk) 04:16, 8 January 2009 (UTC)

This is a matter of seconds (or milliseconds) now. Also, the assertion that web browsers require 128-bit encryption seems a bit suspect. Perhaps this whole page should be rephrased to be more historical in its tone: "When export of stronger encryption was legalized in the US, 40-bit keys could be cracked on consumer hardware in a matter of weeks" or whatever Schneier said. I don't have a copy of Applied Cryptography handy. — Preceding unsigned comment added by 173.48.49.222 (talk) 20:48, 22 February 2018 (UTC)