I am a newbie here, this is my first post. I have searched the forum but I haven

Question

I am a newbie here, this is my first post.

I have searched the forum but I haven't found a clear answer to this.

In general. What is the relationship between key length and the keyspace? (if there is any at all)

For example, with the Simple Substitution Cipher, I understand that the keyspace is 26! (because there are 26 characters in the English alphabet)

The key length is 26? (due to 26 characters in the english alphabet) Is it?

The keyspace seems to be quite long, isn't it? so looking at the keyspace the 'Simple Substitution Cipher' would be quite secure. But looking at the keylengh, being only 26 long, how could this be considered secure by today standards?

Could anyone shed some light here? Again, sorry for my naivity if I am missing something important here.

Thanks in advance

Explanation / Answer

Key length is the length of the key. It's a term whose meaning has evolved over time; these days, it typically means length in bits. With digital symmetric ciphers, it's fairly simple, because those tend to have a key that's just a string of some number of bits, and any string of that length is a valid key. With RSA, it's more complicated - the key has a bunch of elements, and can be written in various formats or with more or less info. With algorithms like that, there's generally some standard thing whose length is the key length (with RSA, it's the modulus).

The key space is the set of all possible keys. With symmetric ciphers, where any string of n bits is a valid key, the key space has 2n elements. With asymmetric ciphers, it's more complicated.

With monoalphabetic substitution ciphers, you have 26! keys, but key length depends on how you're expressing the key. If you compress the key as much as possible, you can fit it in 89 bits (288<26!<289), so if you want to directly compare key length with other symmetric algorithms (to talk about brute-forcing) you'd say it has an 89-bit key. Expressed another way, it has a 26-letter key, but not all 26-letter keys are valid keys (AA...AA isn't, for instance). But letters are not bits; if each letter is encoded in 5 bits, this is a 130-bit key, but very few of the 130-bit keys are valid. That's why you'd look at the smallest you could possibly make the key, which is 89 bits.

This is actually reasonably long; it's weak by modern standards, but in the 1980s and 1990s would have been fine. The issue is that you don't attack it by brute-force, but by cryptanalysis; that means key length is a bit beside the point.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.