Federal government finally adopts tighter encryption standard - Top Technology Showcase

Computer Technology Review, Jan, 2002 by Joshua Piven

Amid widespread calls for stricter data security standards and technological solutions to protect the nation's critical systems, Secretary of Commerce Don Evans announced in December approval of a new encryption standard for the federal government.

The Advanced Encryption Standard (AES) includes a 256-bit key; the previous Data Encryption Standard (DES), which the government adopted in 1977, used a 56-bit key and was surpassed by the 128-bit encryption adopted in the private sector in the early 1990s. AES is also expected to be used in the private sector, and includes an algorithm that incorporates the Rijndael (pronounced Rhine-doll) encryption formula. Belgian cryptographers Joan Daemen and Vincent Rijmen developed Rijndael and both have agreed that their algorithm can be used without royalty fees.

According to the Commerce Department, each of the algorithms submitted for the AES competition was required to support key sizes of 128, 192 and 256 bits. For a 128-bit key, there are approximately 340 undecillion (340 followed by 36 zeros) possible keys. By contrast, a 256-bit key allows for a total combination set of 11 followed by 76 zeros.

The weaker DES standard was shown to be breakable several years ago: specialized systems can crack a DES key in just a few hours. By contrast, 128-bit encryption is widely believed to be unbreakable using current technology. The National Institute of Standards and Technology says that even assuming someone could build a machine that could crack a DES key in one second, it would take that same machine 149 trillion years to crack a 128-bit key.