up vote -1 down vote favorite
share [g+] share [fb]

Let's say personal contact information. Besides the laws that need to be met in the jurisdiction, do we need the best encryption or just something that won't be broken for, say, 100 years?

link|improve this question
64% accept rate
What do you mean "left in public?" – Josh K Mar 6 '10 at 5:18
The irony is I couldn't post this question on stackoverflow because it's not a programming question so I figured it must be a superuser question and now it's closed here. Any other place I should put this? – John K Mar 6 '10 at 20:42
this question is really aimed more at theoretical encryption, isn't it? SU is discouraging open-ended discussion questions, in favor of specifics. SO and SF may allow open-ended questions on certain topics, and this might be a fit for SF, but it is too open-ended for SU. – quack quixote Mar 6 '10 at 22:08
feedback

closed as off topic by Diago Mar 6 '10 at 10:10

Questions on Super User are expected to generally relate to computer software or computer hardware, within the scope defined in the faq.

3 Answers

up vote 0 down vote accepted

The best encryption would be pretty much that, something that would take a long time to break, nothing is unbreakable given a lot of time and computer power, choosing an encryption is pretty much finding out how much is the data worth, how much would someone spend to get it, is the data worth 100 years of research and computer power?.. 10? 2?

Look here for links to detailed information about the most popular algorithms.

link|improve this answer
Brute force attacks will take an infinite amount of time on some algorithms. – Josh K Mar 6 '10 at 6:06
Is brute force attack the only method of attack? – OldJim Mar 6 '10 at 6:17
4  
Josh: NO, brute force attacks will probably take an infinite amount of time. A cracker could also crack it on his first attempt, albeit at a very small chance. OldJim: NO, brute force is certainly not the only method of attack. Often, other methods like analysing the encryption and finding weaknesses that make it quicker to crack (reducing its complexity and the number of possibilities for bruteforce attempts) are used. More often still, social engineering attacks, like simply calling the victim, claiming to be someone important, and asking for the password or a copy of the key are used. – Lee B Mar 6 '10 at 7:52
There is a finite number of combinations to try, thus bruteforcing is a method that will always work, and always produce results (Providing the bruteforcer is inputting in the right way. All potential passwords, all potential fingerprints, so on), it's not something you can stop. You can make it not-viable by using a long string of alphanumeric characters (With symbols, if possible), and it won't be a legitimate attack for most cases for many, many years. (However, my school uses 5-letter dictionary words for every password, and no login count restrictions. THAT'S when brute-forcing is useful. – Phoshi Mar 6 '10 at 21:08
feedback
up vote -1 down vote

With Google and a large number of sites that don't secure it, personal contact information is one of last things I would be worried about.

Keeping information secure is more common sense then encryption. Don't fill out information on web sites, don't leave your computer laying around, don't email sensitive information.

link|improve this answer
feedback
up vote -1 down vote

Most jurisdictions have some sort of law or recommendation about this, which your government's IT Security branch will be able to advise you on. In the US, I believe triple-DES is now required for securing government data (it used to be DES, but that was deemed too weak after a while). AES is also pretty good. Whatever algorithm you use should researched and understood well, including what strength (number of bits) to use for your scenario, where appropriate. By scenario, I mean, don't think "100 years is fine". 100 years for a schoolkid trying to break his teacher's password is a lot different for 100 years from a government agency suspecting a teacher of selling secrets to another government. Just like in physical security, evaluate your foes, then evaluate the protection you need.

link|improve this answer
1  
hello! welcome to 2010. NIST has been recommending AES since 2001, and before that had been recommending triple-DES for some time. i think DES was officially withdrawn in 2005 but hadn't been actively recommended since... not sure exactly. they were recommending transition from DES to triple-DES in 1999 ... – quack quixote Mar 6 '10 at 22:05
Just discovered the new official status of this recently myself. Thanks for the update :) – Lee B Apr 29 '10 at 18:47
feedback

Not the answer you're looking for? Browse other questions tagged or ask your own question.