As a sidebar, what type of encryption available mainstream today is considered robust enough to prevent cracking at all but the highest levels ( i.e. brute force by super computer or elite hacker types)? My knowledge of encryption is rather basic. I'm curious about how stout current encryption techniques are.
There are a number of standard encryption techniques which are widely used and are considered completely unbreakable by any means, and generally considered unbreakable by any plausibly forseeable type of technology.
This includes things like 128 bit (or 256 bit) AES (for symmetric encryption), 256 bit (or higher) elliptic curve encryption (for digital signatures and asymmetric encryption) and SHA-2 256 bit (or higher) for cryptographic hashing.
The only real potential issue is that of quantum computing - if a real quantum computer could be built, it could potentially work against ECC highly effectively. However, quantum computers are pretty much a total unknown - people have been working on these for decades and have made surprisingly little progress.
There is a little concern that some cyptographic algorithms may be have been tampered with - e.g. ECC. To make this work, you first have to agree on a "curve" to be used. The US govt published a list of "preferred" curves, but just appears to have magicked them out of thin air - for all anyone knows, the NSA could have come up with them, because they have some kind of known (to them) unknown (to the general public) defect. Of course, there are plenty of "open source" curves available, but not all software supports them; and if you are a software developer and want to sell your software to businesses and the govt, then you'll want federal certification on it - and that means you have to use the govt's curves.
The big risks with encryption today, are people using it incorrectly. That includes user error and programmer error (i.e. subtle bugs in the encyption software or OS).
Examples of bugs that have caused issues are things like the random number generator bugs. When you set up an SSL connection, the first thing that happens is that your computer generates a random symmetric (e.g. AES) key. That key is then transmitted to the server using an asymmetric encryption technique (RSA or ECC). Once the server has received the key over the extremely CPU intensive ECC/RSA channel, that key can be used to run the highly efficient AES encryption. Some OSs (e.g. some versions of android) have shipped with defective random number generators which tend to repeat the same numbers over and over - this can massively weaken security.
The heartbleed bug meant that hackers could retrieve a server's private keys, which would permit them to eavesdrop on their SSL connections.
There is also user error - passwords/passphrases are ridiculously weak compared to even 128 bit AES. Most passwords have barely 40 bits of "strength", even passphrases can be misused (e.g. using a passphrase that has ever been published - e.g. a line of poetry, or a verse from the Bible) because these texts are easily available and there are cracking tools that can use that text as a source.
Facebook
Twitter