Cryptographic key length is a primary factor in encryption strength, with longer keys exponentially increasing the number of possible combinations an attacker must try. Modern standards like AES use 128-, 192-, or 256-bit keys, while the one-time pad remains the only theoretically unbreakable encryption method.
Cryptographic Keys
To create a ciphertext, or an encrypted message, you're going to need to have a message that you want to encrypt, you're going to need to know the cipher or algorithm that you're going to use to encrypt that, and then you're going to need some sort of key to encrypt it and decrypt it. A big part of how secure your ciphertext is going to be is that key, and specifically it's going to be about the key length.
In the next set of examples, we are just going to convert the word "secret" into a ciphertext, and we're going to use a key of eight. What that means is that we've just shifted over this alphabet in this bottom row by eight places. So now this S is going to become an A, and so we have an A there. This E is going to become an M, so we have an M there. This C is going to become a K, so we have a K there. And we've converted this.
Of course, this makes it really easy to hack this message, because all we have to do is — we can see that M is repeating itself, and there's a good guess that that's going to be the letter E, and from there we can reverse engineer this and figure out what our actual plaintext is. So this is very easily crackable with only a key of eight.
To make this message more secure, what we can do is we can add a bigger key. We're using the same algorithm, the same cipher, to encrypt the message. What we're doing is we're just using a larger key to do it.
What we're going to do is take that first number, which is eight, and this first table shows that we've shifted the letters by eight places. Then we take the second one, which is going to be shifted by two places, and then we'll just alternate between these. For the first letter we'll use the first table. The first letter is S, so the S becomes an A. Then we're going to use the second table, which has an E, which on the second table is going to be a G. We go back and use the first table again, which is a C, and a C is a K. And then for the fourth letter, it is R, so we're going to use the second table again, and R becomes a T. And then we have another E, but this time we're using the first table for this E, so that becomes an M.
Notice that our two E's now are two different letters. We've just drastically increased the security of this by adding a second number to this. So it made a huge difference, although it's still pretty easy for a computer to hack this.
As you can imagine, if we make our key even longer, we've added more security. Now we have three tables, and the first letter will use the first table, the second letter will use the second table, and the third letter will use the third table, and we'll start it all over again. Therefore we will make a much more safe ciphertext with this that's going to be much harder to reverse engineer and figure out what the plaintext is.
The keys on your computers are actually going to look a little different. Computers use binary numbers, so we measure these keys in how many bits, and the bits are either a one or a zero. In this case right here, we've got 1, 2, 3, 4, 5, 6, 7, 8, so we have eight positions here. Here we have 10 positions: 3, 4, 5, 6, 7, 8, 9, 10.
Every time we add a bit to a key, we actually double its complexity and make it that much harder to figure out what the key is going to be. So let's take a look at what that looks like. It's the powers of two. We start out with one bit. A one bit can be two possibilities: from a computer standpoint, it's either a zero or a one, so there are two different states. When we go to two bits, we actually double that to four possibilities. We've got 0, we've got 1, we've got 10, and 11. Now let's add another bit and we double it again. Now there are eight possibilities, so we could have 0, 1, 10, 11, 100, 101, 110, and 111.
The equation to figure out how many possibilities there are with bits would be two to the however many bits you have. So for instance, 8 bits is 2 to the 8th power, so you have 256. 9 bits is 512. 10 bits is 1,024. 11 bits, 2,048. 12 bits — and you can get the picture, it doubles every time and gets drastically larger.
So the question is, how many bits do we need in our key to create a secure ciphertext? Another way to ask that question would be, what can computers crack? What type of keys can they crack, and how big are those bits? The answer actually changes over time, because the computers nowadays can crack things that we couldn't crack 10 years ago. So we can take a look at history and see what's happened.
With DES — DES was an acceptable standard that a lot of people used and said this is what we're going to use as the standard for encryption. It was 64 bits. It was adopted in 1976; that's when they said this is the approved standard. Even though it was 64 bits, effectively it was 56 bits, because there are some parity bits in there. So if we figure out how many possibilities that key has, it's 2 to the 56th power, which ends up being this number, that's 720 followed by 14 zeros. That is an incredibly large number. I'm not going to write all the zeros out because it's a lot of zeros. This is a huge number — that's how many possibilities there are.
It wasn't until 1997 when it was first cracked. It was cracked again in 1998, from a computer that cost $250,000. Another eight years after that, then it was cracked by a machine that only cost $10,000. And in 2016, just by a standard graphics card that you could buy off the shelf. So our computing power got better and better.
What is the standard now? AES was accepted as the alternate way of encrypting. 2001 is when it became the new standard, and it has actually several settings: 128, 192, 256. So it actually has different numbers here: 36 zeros, 55 zeros, and 75 zeros. You can see, pretty complex, especially compared to the DES right here.
One of the questions you might ask is, well, why don't we just always use 256? That's the most secure, it's got the most digits in it, so why don't we just always use 256? Well, there is processing load. What happens is that if you're encrypting everything at 256, you might be just spending a lot of extra time and a lot of extra energy in encrypting things that's not necessarily needed — that 128 might be secure enough for you. So it changes over time, and we also have to have other considerations, like how long is it going to take, what's the processing load that it's going to be, and how much delay is there because you're encrypting things.
That brings up an interesting point. Whatever key you create will probably be able to be cracked at some point in time. However, there is one exception to that, and it's a theoretical exception, and that is that there is a one-time pad that theoretically can't be cracked.
So what does a one-time pad look like? It follows several rules:
If these are followed, then theoretically you could create a key that is uncrackable.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →