Why use symmetric cryptography over public-key? I thought RSA was theoretically secure as long as factoring sufficiently large prime numbers is impossible.
First, RSA is about factoring composites.
Second, factoring those composites at popular key sizes isn't impossible.
Third, public-key algorithms are much harder to get right; they involve direct mathematical operations on plaintexts and devolve to well-studied math problems much more readily than symmetric ciphers do.
You should absolutely avoid public-key crypto, including public-key key agreement schemes like Diffie-Hellman, if your needs don't absolutely require them.
Is there an alternative to public-key crypto? We all need to do stuff online.
This is "sort-of" what I've come to think Miranda was facilitating for Greenwald - it makes little sense that the purpose was for him to mainly carry documents, as while the documents would be more secure if he was not stopped vs. transferring them via the internet, they would have had to consider the possibility that he might be.
But if you pass along a lot of random data, then if it never leaves your possesion, you can be reasonably sure that that data can be safely used as a source for one time pads or keys. If it gets intercepted, then so what? You just ignore that batch of data even if it is handed back to you.
Of course, with UK law saying they can detain you indefinitely until you hand over your keys if they think a file is encrypted, that might not be a good move... though obviously in retrospect they didn't make use of that here.
No I got that just fine. As you know, I'm suggesting that not using public-key crypto or something else for the same purpose is impractical.
Yet what of basic online communications where key-exchange is necessary and where we have very little say about the protocols involved?
Always avoiding public-key isn't really possible unless you have some sort of secure channel to agree on a key for some communication. But then again, if you have that channel, you might just as well communicate through that.
When encrypting files locally though, there is absolutely no reason I can think of to use public-key cryptography.
So that you don't lose your decryption key just because your computer was encrypting when it was seized?
Of course, if the weaknesses are sufficient, then that's irrelevant, but it's certainly "a reason".
Also, while PKE is sensitive to implementation issues and parameter choices, you can have much higher assurance that there are no theoretical weaknesses than you can have with something like AES. With PKE you usually have a proof that the security of the system depends on the hardness of one problem, regardless of the specific attack strategy the adversary uses. We do not say that ElGamal is secure against chosen plaintext attacks because we ran a battery of tests designed to detect vulnerabilities to particular CPA strategies; we say it is secure because we can prove that any CPA attack on ElGamal can be used to solve the DLOG problem, and so we only really have to worry about the lower bound on solutions to one problem. With something like AES we only test for certain attack strategies and a few general heuristics that suggest a block cipher is secure.
This is not to say that AES is not secure, nor that PKE is a magic bullet.
You probably didn't mean it that way but I feel like fixing that. Prime numbers have no factors except for 1 and themselves. That's the definition of a prime number. What you're thinking about are composites which are a product of two large prime numbers.
[1] http://en.wikipedia.org/wiki/Primality_test#Fast_determinist...