In giving presentations on cryptography and encryption key management, I am frequently asked about key size. Specifically, the question I am asked is if a 128-bit or 256-bit encryption key is enough. It does not matter what answer I give, the follow on question is usually predictable: Given Moore’s Law, when will that key size be inadequate?

We need to back up a little to answer this question, and we also need to put it into the perspective of money. We can easily get lost in the world of transistors, MIPS, TFLOPS, algorithms, processors and other technobabble (which is proudly part of my lexicon), but let me restate this concern from a monetary perspective: How much money does it cost to test every possible key in a 128-bit (or 256-bit) key space and how long will it take?

For people not familiar with Moore’s Law, it was a forecast by Gordon Moore of Intel fame who, in 1965, forecast that the number of transistors on integrated circuits would double every two years. For the most part, the computer industry has followed this forecast and that is why our smart phones have more than 100-times the computing power of the computers that launched the first space shuttle. This is beautiful thing, and we all have benefited from this explosion in computing power. But there can be dark side: using that computing power for nefarious purposes.

In other words, if you are a business and encrypting your data using a 256-bit encryption key, do you have to be concerned that Joe Hacker can harness the power of the cloud to get to your data by trying every possible key? As we address this concern, we must avoid getting lost in big numbers, like 256-bits, and losing perspective of what that actually means. For the forgetful, a key in a 256-bit key space is really just a single number that is somewhere between zero and 2 to the power of 256. (For those who like decimal values, that is 10^77, or simply 1 followed by 77 zeros). That is a BIG number. But, to put it in perspective, let’s look at another big number: all the atoms in the known universe.

The number of atoms in the known universe is estimated to be about 10^80 (again, 1 followed by 80 zeros). Nobody has a precise count of the atoms in the universe, so let’s us just say that the number of atoms is “about” the same as the number of keys in a 256-bit key space. That is a LOT of possible keys.

Key Management: Bringing It Home

So, I may be losing you in the numbers, but here is the essence of the message. The amount of money required to test every key in a 256-bit key space is going to be close to the amount of money that would be required to pay for the energy to move each atom in the universe, even by just a little. In other words, no human can afford enough computing power to test all of those keys. From an energy perspective, it would take more energy to drive the computers to perform the work (regardless of how many transistors they have) to try all the keys in a 256-bit key space than the planet produces over our lifetimes. For a 128-bit key, it’s estimated that it would take 1% of the world energy production for a full year. This is a LOT of power.

From a business perspective, how much is the encrypted-data worth? Is it worth a billion dollars? Is it worth a trillion? Or is it just worth a few thousand dollars? If the quarterly report of a public company was stored in an encrypted file and protected by a 256-bit key, how much money would you invest in computers to try to test every key (also known as a brute force attack)? Realistically, the ROI is just not there. And then consider that, with very little work, we can encrypt the file under more than one key. We could even encrypt each word under a different key. You would have a better chance of winning the lottery (about 1 in 10^8) than ever lucking upon the right key. It is simply too expensive (and will continue to be too expensive, if not completely impossible) to brute force attack keys. They are just too big.

At the end of the day, key management helps us use and manage millions of keys in cryptography to protect our data. It is easy. But because the keys are so big (even 128-bit symmetric keys), attempting to access the data by trying all possible keys is simply not feasible for the bad guys. They need to find another approach: guessing your password, hoping that you don’t encrypt your data, finding a way to have you “give” them the key through social engineering, phishing attacks or other sneaky tricks to fool you.

Read the white paper: Three guiding principles to improve data security and compliance

So, don’t worry about cryptography or your encryption keys. Use AES and key sizes of 128-bits or greater. Even NIST considers 128-bit keys acceptable in their SP800-131A publication. Moore’s Law has a long way to go before our keys will be realistically breached through a brute force attack.

More from Cloud Security

How I got started: Cloud security engineer

3 min read - In today’s increasingly cloud-focused business environment, cloud security engineers are pivotal in protecting an organization’s critical data and infrastructure. As experts in cloud security, they leverage their expertise to ensure that the ever-expanding amount of cloud data is safe from emerging threats and vulnerabilities. Cloud security professionals combine their passion for technology with a deep understanding of security principles to design and implement robust cloud security strategies. What experience do these security experts have, and what led them to the…

“Authorized” to break in: Adversaries use valid credentials to compromise cloud environments

4 min read - Overprivileged plaintext credentials left on display in 33% of X-Force adversary simulations Adversaries are constantly seeking to improve their productivity margins, but new data from IBM X-Force suggests they aren’t exclusively leaning on sophistication to do so. Simple yet reliable tactics that offer ease of use and often direct access to privileged environments are still heavily relied upon. Today X-Force released the 2023 Cloud Threat Landscape Report, detailing common trends and top threats observed against cloud environments over the past…

Lessons learned from the Microsoft Cloud breach

3 min read - In early July, the news broke that threat actors in China used a Microsoft security flaw to execute highly targeted and sophisticated espionage against dozens of entities. Victims included the U.S. Commerce Secretary, several U.S. State Department officials and other organizations not yet publicly named. Officials and researchers alike are concerned that Microsoft products were again used to pull off an intelligence coup, such as during the SolarWinds incident. In the wake of the breach, the Department of Homeland Security…

What you need to know about protecting your data across the hybrid cloud

6 min read - The adoption of hybrid cloud environments driving business operations has become an ever-increasing trend for organizations. The hybrid cloud combines the best of both worlds, offering the flexibility of public cloud services and the security of private on-premises infrastructure. We also see an explosion of SaaS platforms and applications, such as Salesforce or Slack, where users input data, send and download files and access data stored with cloud providers. However, with this fusion of cloud resources, the risk of data…