The "bit" length really doesn't make or break the security, if the algo is done well, and tested, 128-bit is sufficent when the passphrase is good. 123456789101112131415 is a long pass, but not a well chosen one. Varied cases, numbers and symbols each increase the possiblities exponentially, as well as length. I'd suggest reading the following articles to help further understand what makes good crypto: http://www.schneier.com/cr
http://www.schneier.com/es
Strong cryptography is very powerful when it is done right, but it is not a panacea. Focusing on the cryptographic algorithms while ignoring other aspects of security is like defending your house not by building a fence around it, but by putting an immense stake into the ground and hoping that the adversary runs right into it. Smart attackers will just go around the algorithms.
http://www.schneier.com/pa
http://www.schneier.com/cr
Comparing symmetric and public-key keys is a lot like comparing apples and oranges. I recommend 128-bit symmetric keys because they are just as fast at 64-bit keys. That's not true for public-key keys. Doubling the key size roughly corresponds to a six-times speed slowdown in software. This might not matter with PGP, but it will make client-server applications like SSL slow to a crawl. I've seen papers claiming that you need 3072-bit RSA keys to correspond to 128-bit symmetric keys and 15K-bit RSA keys for 256-bit symmetric keys. This kind of thinking is ridiculous; the performance trade-offs and attack models are so different that the comparisons don't make sense.
http://schneier.com/book-p
Sorry to link so many, but it's a topic that comes up alot, and hearing it from a real-world expert like Mr Schneier is probably better than me reguritating it and possibly messing it up. I also recommend TrueCrypt, it has several algo's to choose from, and Blowfish was also written by Mr. Schneier. TrueCrypt should not be used to encrypt windows program and system files, it's not designed to work in this fashion. It can encrypt other files/folder on a pc, or even an entire secondary drive/partition or USB device, but it has no bootloader to make the system understand that the entire HD is encrypted. PGP offers something along those lines and I'm told by a friend that it does work well, and encrypts the entire boot drive and anything else. It requires a password, and a USB token to boot the PC. Seagate also has an entirely encrypted harddrive comming to market later this year, all content on the HD is encrypted, and the crypto is transparent as it's handled by the HD's hardware. http://www.seagate.com/cda
Security is a process, not a product.
-rich
Main Topics
Browse All Topics





by: t_itaniumPosted on 2006-06-27 at 00:36:47ID: 16990445
see this !
http://www.truecrypt.org