40-bit encryption
Encyclopedia
40-bit encryption refers to a key size
of forty bits, or five byte
s, for symmetric encryption; this represents a relatively low level of security. A forty bit length corresponds to a total of
possible keys. Although this is a large number in human terms (about a trillion, nearly two hundred times the world's human population), it is possible to break this degree of encryption using a moderate amount of computing power in a brute force attack
— that is, trying out each possible key in turn.
A typical home computer in 2004 could brute-force a 40-bit key in a little under two weeks, testing a million keys per second; modern computers are able to achieve this much faster. Using free time on a large corporate network or a botnet
would reduce the time in proportion to the number of computers available. p.154 With dedicated hardware, a 40-bit key can be broken in seconds. The Electronic Frontier Foundation
's Deep Crack, built by a group of enthusiasts for US$250,000 in 1998, could break a 56-bit Data Encryption Standard
(DES) key in days, and would be able to break 40-bit DES encryption in about two seconds.p. 153
40-bit encryption was common in software released before 1996, when algorithms with larger key lengths could not legally be exported
from the United States without a case-by-case license.p.615 As a result, the "international" versions of web browser
s were designed to have an effective key size of 40 bits when using Secure Sockets Layer to protect e-commerce. Similar limitations were imposed on other software packages, including early versions of Wired Equivalent Privacy
. In 1992, IBM
designed the CDMF
algorithm to reduce the strength of 56-bit
DES against brute force attack to 40 bits, in order to create exportable DES implementations.
s, and therefore cannot be regarded as secure. As a result, virtually all web browsers now use 128-bit keys, which are considered strong. Some web server
s will not communicate with a client unless it has a 128-bit encryption capability installed on it.
It should also be noted that public/private key pairs used in asymmetric encryption (public key cryptography) must be much longer than 128 bits for security; see key size
for more details.
As a general rule, modern encryption algorithms such as AES
use key lengths of 128, 192 and 256 bits.
Key size
In cryptography, key size or key length is the size measured in bits of the key used in a cryptographic algorithm . An algorithm's key length is distinct from its cryptographic security, which is a logarithmic measure of the fastest known computational attack on the algorithm, also measured in bits...
of forty bits, or five byte
Byte
The byte is a unit of digital information in computing and telecommunications that most commonly consists of eight bits. Historically, a byte was the number of bits used to encode a single character of text in a computer and for this reason it is the basic addressable element in many computer...
s, for symmetric encryption; this represents a relatively low level of security. A forty bit length corresponds to a total of
possible keys. Although this is a large number in human terms (about a trillion, nearly two hundred times the world's human population), it is possible to break this degree of encryption using a moderate amount of computing power in a brute force attackBrute force attack
In cryptography, a brute-force attack, or exhaustive key search, is a strategy that can, in theory, be used against any encrypted data. Such an attack might be utilized when it is not possible to take advantage of other weaknesses in an encryption system that would make the task easier...
— that is, trying out each possible key in turn.
A typical home computer in 2004 could brute-force a 40-bit key in a little under two weeks, testing a million keys per second; modern computers are able to achieve this much faster. Using free time on a large corporate network or a botnet
Botnet
A botnet is a collection of compromised computers connected to the Internet. Termed "bots," they are generally used for malicious purposes. When a computer becomes compromised, it becomes a part of a botnet...
would reduce the time in proportion to the number of computers available. p.154 With dedicated hardware, a 40-bit key can be broken in seconds. The Electronic Frontier Foundation
Electronic Frontier Foundation
The Electronic Frontier Foundation is an international non-profit digital rights advocacy and legal organization based in the United States...
's Deep Crack, built by a group of enthusiasts for US$250,000 in 1998, could break a 56-bit Data Encryption Standard
Data Encryption Standard
The Data Encryption Standard is a block cipher that uses shared secret encryption. It was selected by the National Bureau of Standards as an official Federal Information Processing Standard for the United States in 1976 and which has subsequently enjoyed widespread use internationally. It is...
(DES) key in days, and would be able to break 40-bit DES encryption in about two seconds.p. 153
40-bit encryption was common in software released before 1996, when algorithms with larger key lengths could not legally be exported
Export of cryptography
The export of cryptography in the United States is the transfer from the United States to another country of devices and technology related to cryptography....
from the United States without a case-by-case license.p.615 As a result, the "international" versions of web browser
Web browser
A web browser is a software application for retrieving, presenting, and traversing information resources on the World Wide Web. An information resource is identified by a Uniform Resource Identifier and may be a web page, image, video, or other piece of content...
s were designed to have an effective key size of 40 bits when using Secure Sockets Layer to protect e-commerce. Similar limitations were imposed on other software packages, including early versions of Wired Equivalent Privacy
Wired Equivalent Privacy
Wired Equivalent Privacy is a weak security algorithm for IEEE 802.11 wireless networks. Introduced as part of the original 802.11 standard ratified in September 1999, its intention was to provide data confidentiality comparable to that of a traditional wired network...
. In 1992, IBM
IBM
International Business Machines Corporation or IBM is an American multinational technology and consulting corporation headquartered in Armonk, New York, United States. IBM manufactures and sells computer hardware and software, and it offers infrastructure, hosting and consulting services in areas...
designed the CDMF
CDMF
In cryptography, CDMF is an algorithm developed at IBM in 1992 to reduce the security strength of the 56-bit DES cipher to that of 40-bit encryption, at the time a requirement of U.S. restrictions on export of cryptography. Rather than a separate cipher from DES, CDMF constitutes a key generation...
algorithm to reduce the strength of 56-bit
56-bit encryption
In computing, 56-bit encryption refers to a key size of fifty-six bits, or seven bytes, for symmetric encryption. While stronger than 40-bit encryption, this still represents a relatively low level of security in the context of a brute force attack....
DES against brute force attack to 40 bits, in order to create exportable DES implementations.
Obsolescence
All 40-bit and 56-bit encryption algorithms are obsolete because they are dangerously vulnerable to brute force attackBrute force attack
In cryptography, a brute-force attack, or exhaustive key search, is a strategy that can, in theory, be used against any encrypted data. Such an attack might be utilized when it is not possible to take advantage of other weaknesses in an encryption system that would make the task easier...
s, and therefore cannot be regarded as secure. As a result, virtually all web browsers now use 128-bit keys, which are considered strong. Some web server
Web server
Web server can refer to either the hardware or the software that helps to deliver content that can be accessed through the Internet....
s will not communicate with a client unless it has a 128-bit encryption capability installed on it.
It should also be noted that public/private key pairs used in asymmetric encryption (public key cryptography) must be much longer than 128 bits for security; see key size
Key size
In cryptography, key size or key length is the size measured in bits of the key used in a cryptographic algorithm . An algorithm's key length is distinct from its cryptographic security, which is a logarithmic measure of the fastest known computational attack on the algorithm, also measured in bits...
for more details.
As a general rule, modern encryption algorithms such as AES
Advanced Encryption Standard
Advanced Encryption Standard is a specification for the encryption of electronic data. It has been adopted by the U.S. government and is now used worldwide. It supersedes DES...
use key lengths of 128, 192 and 256 bits.