A **cryptographic key** is a relatively small amount of information that is used by a cryptographic algorithm to 'customize' the transformation of plaintext into cyphertext (during encryption) or vica versa (during decryption). The same algorithm and plaintext, but with a different key will produce a quite different cyphertext, and so for decryption as well. If the decryption key is lost, encrypted data will not in practice be convertible back to its original form -- at least for high quality encryption algorithms and large enough key sizes. Thus, the security of a cryptographic key in most cases relies on its being kept secret: hence the alternative name **secret key**.

Most cryptographic algorithms use a single key for both encryption and decryption: they are known as symmetric key algorithms. An attacker who obtains the key (by theft, extortion, dumpster diving, or inspection of a Post-It note stuck to the side of a terminal) can recover the original message from the encrypted data, since as a matter of principle the details of the cryptographic algorithm used is assumed to be already available to the attacker. This design assumption is usually known to cryptanalysts as Kerckhoffs' law -- '...only secrecy of the key provides security...', or in more colloquial form, Shannon's Maxim -- '...the enemy knows the system...'. In either form, it is fully justified by long and painful practical experience over some thousands of years and no recent development has changed this reality; indeed there is widely thought to be no prospect of change. That secrecy of a crypto system (the algorithms or the protocols) is important (or even vital) is widely, and wrongly, believed. As a general principle one would not want one's crypto system to be fully known to the opposition, but it should remain secure even if the opposition learns all about it. The chances are excellent that they will anyway.

A new class of cryptographic encryption algorithms was discovered in the 1970s which use a pair of keys, one to encrypt and one to decrypt. Some of these asymmetric key algorithms have the property that it is not possible to determine one key from the other (so far as is currently known). Such an algorithm allows one key to be made public while retaining the private key in only one location.

Table of contents |

2 Key Choice |

Typical key sizes for estimated 'equivalent security' against a particular kind of attack (ie, brute force key space search) are 128 bits for symmetric ciphers and 2048 bits or more for public key cryptography. Elliptic curve cryptography may allow much smaller size keys for equivalent security, but these algorithms have only been known for a relatively short time and current estimates of the difficulty of brute force searching for their keys may not survive. Recently, a message encrypted using a 109-bit key elliptic curve algorithm was broken by brute force. As a result it would appear that elliptic curve algorithm keys must be somewhat the same length as symmetric key algorithm keys for equivalent security. As always, for all but the one-time pad, a theoretical breakthrough may make everything you've encrypted an open book regardless of the algorithm or algorithm type you've chosen, and a too-short key will certainly do so.

If the key is too small, the algorithm will be vulnerable to a brute force attack in which all possible values of the key are tried one by one. 'Birthday' attacks are also possible; the probability of a 'collision' between a large group of values goes up roughly as the square of the number of possible values and this applies in cryptography as well. In addition, many algorithms permit reduced effort attacks as compared to brute force key search. If the effort is sufficiently reduced, the algorithm will be 'insecure' against that attack and should not be used. It may be expected that algorithms for which no improved attack is now known, and for which a brute force attack is impractical, will be found to be insecure when some new cryptoanalytic technique is developed. When one is.

The problem of choosing a cryptographic algorithm reduces itself, in actual practice, to an estimate of how likely such an advance will be over the relevant time. Personal secrets need to be kept confidential for different durations than tactical deployment information in a battle, and still differently than some commercially valuable information (eg, the formula for Coke). There are no good answers known to this problem. Intelligent, cryptographically informed, choosers limit their choice to publicly known and publicly unbroken, but well studied, algorithms. Only algorithms from this group can be credibly thought secure. All others are either not sufficiently well tested, or are from secret organizations with adequate testing resources, but also with ulterior motives.

- http://www.pobratyn.com/pk.php3 An example of a PGP Public Key. -- broken link
- The official site for PGP International and, unofficially, for GPG.
- Crypto-Gram, a monthly online publication on cryptography and its sensible use.