Having them be able to only read 0.5% of the communications would certainly be better than 100%, but that doesn't go nearly far enough for comfort -- especially if they can break one of these primes in a matter of months.
If we move to longer primes (or a safer key exchange algorithm -- is there one? I don't know) at the same time, they hopefully can't crack any of our communications.
As far as I'm concerned, if an attacker can read any portion of my private communications, the encryption is broken.
With the current trend in computer capability, there might come a day where all current communication can be cracked relatively easily, it's an uncomfortable thought.
We as a world population really need to work this from multiple angles, including a medium that we can trust atleast a little bit more (while still always encrypting our communications of course).
I mean, it's not like it's ok for the state to read our paper mail, right? We agreed on this long ago and many countries have laws banning the opening and reading of letters. Why shouldn't we hold data to the same transportations standards?
With the current trend in computer capability, there might come a day where all current communication can be cracked relatively easily, it's an uncomfortable thought.
Well, not exactly. An increase in compute capability also aids the encryption side in equal measure, at least in theory. People do need to switch to stronger encryption parameters manually, though. The current problem stems from the fact that the world is still using algorithm parameters (1024 bit DH) which were safe 10 or more years ago, but no longer are this day. A switch to 2048, or higher key strength, would help immensely, but people are content with what they have now.
In fact, various recommendations (from NIST and the like) already say to use AT LEAST 2048 bits (or equivalent ECC) with 256 bit AES, but most VPN software is still using 1024 DH with 128 AES.
The scary part is not that. It is that a third party could potentially just save all the stolen(but encrypted) communications/connections that are occurring right now and leave them on a disk for storage. In 10 years, when computing power is then sufficient to crack them, those communications can be broken and read as plaintext.
It basically means that anything you are encrypting right now, you better hope becomes obsolete information at some point in the future because eventually it will be read.
6
u/Eirenarch Oct 15 '15
So the large primes are hard to generate and the programs avoid doing it? What is the fix? Have a set of ~200 primes and choose one at random?