Front cover - IBM Redbooks

encryption is often referred to as bulk encryption, because it is effective on large
data volumes.
Disadvantages of symmetric key algorithms
The key disadvantage of symmetric ciphers are that there is inherent difficulty
with the administration of the symmetric keys used for encryption. More
specifically, how can you safely get them into the hands of your counterparts
without getting them compromised?
In the next section we show how this key management problem is resolved with
the use of asymmetric key algorithms, but there are shortcomings with the use of
asymmetric keys that still require the use of symmetric key algorithms and
symmetric keys.
Commercial and export considerations
Before we go on to the topic of asymmetric keys, let’s complete the review of
important details about symmetric key algorithms.
The algorithms are published openly and there are no commercial licensing
issues to be considered in implementing them.
They all fall under the control of the US National Security Agency export
restrictions. The precise operation of these restrictions is not a simple matter, but
in essence that means that:
► Any software incorporating cryptographic technology that is exported by a US
company has to have a special export license.
► If the product includes symmetric encryption code that can be used for
encrypting an arbitrary data stream, the license will only allow unrestricted
export if the key size is smaller than a given, NSA-specified, value.
What this means is that to export full-strength cryptography, a company has to
have a special license for each customer. Such licenses are only issued for
customers that the US government considers to be friendly, such as major banks
and subsidiaries of US companies.
When the previous redbook was written, the threshold key size for a general
export license was 40 bits. Since then, several challenges have shown that a
brute force attack can be mounted against a 40-bit key with relatively modest
computing power. A government announcement opened the door to the use of
larger keys, initially up to 56 bits, with the promise of unlimited key sizes when the
computer industry develops effective key recovery technology. (Key recovery
means that the key for a session can be discovered, given the knowledge of
some other, master, key). 56 bits may not sound a lot better than 40, but in fact it
is 2 to the power 16, or 65,536 times more difficult to crack.
Chapter 1. Fundamentals of IT security 29