# What's the strongest publicly-available encryption? **URL:** \ **Category:** Factual Questions\ **Created:** [April 8, 2007, 3:16pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180 "2007-04-08T15:16:59Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![CynicalGabe](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@CynicalGabe](https://boards.straightdope.com/u/CynicalGabe)\ **Post date:** [April 8, 2007, 3:16pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/1 "2007-04-08T15:16:59Z")
Title says it. A friend and I were wondering what the most difficult to break encryption is that’s available to install on a computer. And a second question, what is the strongest one that’s free (no high-end enterprise stuff)? ---
**Author:** ![psychonaut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/psychonaut/32/4655_2.png) [@psychonaut](https://boards.straightdope.com/u/psychonaut)\ **Post date:** [April 8, 2007, 3:20pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/2 "2007-04-08T15:20:22Z")
[QUOTE=CynicalGabe] Title says it. A friend and I were wondering what the most difficult to break encryption is that’s available to install on a computer. And a second question, what is the strongest one that’s free (no high-end enterprise stuff)? [/QUOTE] The [one-time pad](http://en.wikipedia.org/wiki/One-time_pad) is the strongest possible encryption, and is an almost trivial algorithm available to anyone. However, it does have certain practical difficulties relating to the exchange of the key. ---
**Author:** ![yahwc](https://avatars.discourse-cdn.com/v4/letter/y/aeb1de/32.png) [@yahwc](https://boards.straightdope.com/u/yahwc)\ **Post date:** [April 8, 2007, 3:20pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/3 "2007-04-08T15:20:40Z")
You might set up a one-time pad. ---
**Author:** ![Sage\_Rat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sage_rat/32/399_2.png) [@Sage\_Rat](https://boards.straightdope.com/u/Sage_Rat)\ **Post date:** [April 8, 2007, 3:27pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/4 "2007-04-08T15:27:20Z")
Most probably, the “strongest” one will be one of the newest methods. But, since they are new, it’s somewhat unknown which is actually strong and didn’t introduce new flaws while correcting those of previous methods. In general, I would say that you’re fine to just accept anything that’s been accepted as a standard by some organization which knows what it’s doing, and from there just worry about which software has a decent user interface. ---
**Author:** ![mks57](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@mks57](https://boards.straightdope.com/u/mks57)\ **Post date:** [April 8, 2007, 3:52pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/5 "2007-04-08T15:52:52Z")
AES-256 is probably your best bet for modern algorithms. 3DES if you want something that has stood up to attack for many years. ---
**Author:** ![ultrafilter](https://avatars.discourse-cdn.com/v4/letter/u/3d9bf3/32.png) [@ultrafilter](https://boards.straightdope.com/u/ultrafilter)\ **Post date:** [April 8, 2007, 4:26pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/6 "2007-04-08T16:26:28Z")
[QUOTE=mks57] AES-256 is probably your best bet for modern algorithms. 3DES if you want something that has stood up to attack for many years. [/QUOTE] Keep in mind, though, that there’s no guarantee that these won’t both be cracked tomorrow. ---
**Author:** ![mks57](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@mks57](https://boards.straightdope.com/u/mks57)\ **Post date:** [April 8, 2007, 4:33pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/7 "2007-04-08T16:33:48Z")
[QUOTE=ultrafilter] Keep in mind, though, that there’s no guarantee that these won’t both be cracked tomorrow. [/QUOTE] There’s also no guarantee that we won’t be invaded by Martians. ---
**Author:** ![psychonaut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/psychonaut/32/4655_2.png) [@psychonaut](https://boards.straightdope.com/u/psychonaut)\ **Post date:** [April 8, 2007, 5:02pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/8 "2007-04-08T17:02:18Z")
[QUOTE=CynicalGabe] And a second question, what is the strongest one that’s free (no high-end enterprise stuff)? [/QUOTE] There’s no such thing as “high-end enterprise stuff”. The quality of an encryption algorithm is not determined by how much you pay for it. Another member has already mentioned AES256 and 3DES. These algorithms are well-known and widely implemented in free software (and by “free” I mean free of charge as well as free to modify, study, copy, and redistribute). Other popular ciphers include CAST5 and Blowfish. All four of these are implemented by free encryption programs such as [GnuPG](http://www.gnupg.org/). If you want a free, high-quality encryption tool on your computer, you should consider getting GnuPG, plus one of the GUI front-ends and/or e-mail software plugins. But remember to read the documentation—an encryption tool is effective only if it is used properly and if you take the necessary steps to guard your private keys, to guard your passphrases, and to select secure passphrases. The strongest encryption tool in the world isn’t going to protect your data if you leave your private key lying around, or if you choose a short or easily-guessed passphrase. ---
**Author:** ![psychonaut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/psychonaut/32/4655_2.png) [@psychonaut](https://boards.straightdope.com/u/psychonaut)\ **Post date:** [April 8, 2007, 5:16pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/9 "2007-04-08T17:16:59Z")
[QUOTE=Sage Rat] In general, I would say that you’re fine to just accept anything that’s been accepted as a standard by some organization which knows what it’s doing, and from there just worry about which software has a decent user interface. [/QUOTE] That’s a terrible idea; how do you know that the software you are using properly implements the algorithm it says it does, or that it even implements it at all? How do you know it doesn’t accidentally leave plaintext copies of your secret keys and passphrases on your hard drive, or worse yet, surreptitiously send all your passphrases and secret keys to the program’s author? Clearly there is a more important criterion to consider than whether the program has a nice interface, and that criterion is whether the program is subject to peer review. If the author won’t let anyone else examine the source code of his program, then you have only his word that the program does not function improperly or maliciously. On the other hand, if the author makes the source code available to independent third parties (or preferably the public at large), then they will have a chance to scrutinize it, and can report their analyses and criticisms. In this way insecure algorithms, or insecure implementations of algorithms believed to be secure, can be exposed and the public warned. Regrettably, most people don’t care whether the source code is available for their day-to-day software. But when it comes to high-quality encryption software, you’d be a fool not to insist on a Free (i.e., open-source) tool, especially considering the preponderance of [snake-oil cryptography](http://en.wikipedia.org/wiki/Snake_oil_cryptography) and spyware. ---
**Author:** ![Absolute](https://avatars.discourse-cdn.com/v4/letter/a/b2d939/32.png) [@Absolute](https://boards.straightdope.com/u/Absolute)\ **Post date:** [April 8, 2007, 5:24pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/10 "2007-04-08T17:24:50Z")
GnuPG is good for encrypting email messages or other communications - for encrypting your own files, it is somewhat clunky. Another option is [Truecrypt](http://truecrypt.org), which lets you create virtual encrypted disks stored in files on your computer, that you access through an unused drive letter (like W:, for example). Every file you copy to the virtual drive is stored, in encrypted form, in the virtual drive’s file - which you can copy, email, or distribute like any other file. When not in use, the virtual drive files are unidentifiable as anything but random data. You can also encrypt entire hard drives, USB keys, and the like. The software lets you choose from a large number of different encryption algorithms, as well. It really is a great piece of software - there is a Mac OS X version coming soon as well. ---
**Author:** ![psychonaut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/psychonaut/32/4655_2.png) [@psychonaut](https://boards.straightdope.com/u/psychonaut)\ **Post date:** [April 8, 2007, 7:40pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/11 "2007-04-08T19:40:28Z")
[QUOTE=Absolute] GnuPG is good for encrypting email messages or other communications - for encrypting your own files, it is somewhat clunky. [/quote] Being a command-line tool, GnuPG is pretty clunky at everything—hence my suggestion to get a third-party GUI or an application plugin. A file browser extension, for example, will make it easy to encrypt or decrypt individual files on disk using a symmetric cipher. For encrypting an entire filesystem, however, I agree that a dedicated tool like Truecrypt is the way to go. It would help if the OP would indicate how (s)he intends to use the encryption tool; this would help us make more specific recommendations. ---
**Author:** ![Chasing\_Dreams](https://avatars.discourse-cdn.com/v4/letter/c/258eb7/32.png) [@Chasing\_Dreams](https://boards.straightdope.com/u/Chasing_Dreams)\ **Post date:** [April 8, 2007, 11:37pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/12 "2007-04-08T23:37:23Z")
For the truly paranoid, get 10 different encryption programs each using a different encryption scheme. Encrypt your data using all 10 programs, while using a different passcode each time. ---
**Author:** ![WarmNPrickly](https://avatars.discourse-cdn.com/v4/letter/w/d78d45/32.png) [@WarmNPrickly](https://boards.straightdope.com/u/WarmNPrickly)\ **Post date:** [April 9, 2007, 12:03am UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/13 "2007-04-09T00:03:10Z")
> [@](#): > > there is a Mac OS X version coming soon as well. I don’t know what the difference might be, but Mac OS X Disk Utility has already has an encryption scheme. I can make an encrypted disk image with no problem. Perhaps this is something different. ---
**Author:** ![CynicalGabe](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@CynicalGabe](https://boards.straightdope.com/u/CynicalGabe)\ **Post date:** [April 9, 2007, 6:00am UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/14 "2007-04-09T06:00:25Z")
[QUOTE=Chasing Dreams] For the truly paranoid, get 10 different encryption programs each using a different encryption scheme. Encrypt your data using all 10 programs, while using a different passcode each time. [/QUOTE] And then for extra security, expose your hard drive to an 8.21 gigawatt electric field to randomize the encryption! ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [April 9, 2007, 5:35pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/15 "2007-04-09T17:35:36Z")
> [@](#): > > These algorithms are well-known and widely implemented in free software (and by “free” I mean free of charge as well as free to modify, study, copy, and redistribute). I’d just like to point out here that, although you are allowed to modify such a program, I wouldn’t recommend it, unless you know a heck of a lot about encryption and computer security. There are a lot of subtleties involved, and a naïve user might think e’s improving the security, when e’s actually destroying it. This message has been rot-13 encrypted twice, for added security. ---
**Author:** ![Sage\_Rat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sage_rat/32/399_2.png) [@Sage\_Rat](https://boards.straightdope.com/u/Sage_Rat)\ **Post date:** [April 9, 2007, 5:50pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/16 "2007-04-09T17:50:52Z")
[QUOTE=psychonaut] That’s a terrible idea; how do you know that the software you are using properly implements the algorithm it says it does, or that it even implements it at all? [/QUOTE] Unless you can code it yourself, it doesn’t make a difference one way or the other. Even if it’s open source, you would still need to be capable of implementing it just to be able to verify that it was properly implemented. For an average Joe, that’s pretty well out of the realm of feasibility. Obviously, the more research you do on whatever package you are going to go for is better, but at some point you have to assume that the package does what it says, or do it yourself. ---
**Author:** ![WoodenTaco](https://avatars.discourse-cdn.com/v4/letter/w/45deac/32.png) [@WoodenTaco](https://boards.straightdope.com/u/WoodenTaco)\ **Post date:** [April 9, 2007, 7:49pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/17 "2007-04-09T19:49:37Z")
[QUOTE=CynicalGabe] And then for extra security, expose your hard drive to an 8.21 gigawatt electric field to randomize the encryption! [/QUOTE] And then call your buddy to tell him the passwords. ---
**Author:** ![psychonaut](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/psychonaut/32/4655_2.png) [@psychonaut](https://boards.straightdope.com/u/psychonaut)\ **Post date:** [April 9, 2007, 8:15pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/18 "2007-04-09T20:15:37Z")
[QUOTE=Sage Rat] Unless you can code it yourself, it doesn’t make a difference one way or the other. [/QUOTE] Sure it does. With proprietary software, you have only the word of the original implementor, or copyright holder, that the program is secure. And if they’re trying to sell you the product with a view to making a profit, that automatically calls their neutrality and honesty into question. With free software, you often have multiple, independent, and impartial assessments of the program’s security. And even if not, if you can’t program yourself but have some money, you can pay someone else to make such an assessment. ---
**Author:** ![gotpasswords](https://avatars.discourse-cdn.com/v4/letter/g/c57346/32.png) [@gotpasswords](https://boards.straightdope.com/u/gotpasswords)\ **Post date:** [April 9, 2007, 8:26pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/19 "2007-04-09T20:26:30Z")
[QUOTE=Chronos] This message has been rot-13 encrypted twice, for added security. [/QUOTE] Oh man, you got it wrong! You need to use 3R26 encryption - triple rot-26 - or any Cub Scout with a copy of Boy’s Life will be able to crack your stuff. ---
**Author:** ![Tim\_T-Bonham.net](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@Tim\_T-Bonham.net](https://boards.straightdope.com/u/Tim_T-Bonham.net)\ **Post date:** [April 9, 2007, 10:23pm UTC](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180/20 "2007-04-09T22:23:28Z")
[QUOTE=Chasing Dreams] For the truly paranoid, get 10 different encryption programs each using a different encryption scheme. Encrypt your data using all 10 programs, while using a different passcode each time. [/QUOTE] For those who might not realize it, this suggestion is a joke. In many encryption systems, running your plaintext message thru the encryption twice, or running it thru 2 separate encryption algorithims one after the other, generally makes the encryption **weaker**. As I understand it, this tends to expose repeated patterns & shifts that make it easier for an expert analyst to break your encryption. People might have realized that from the follow-up comments, but we should make it clear that this is not a real suggestion. [Next page](https://boards.straightdope.com/t/whats-the-strongest-publicly-available-encryption/399180.md?page=2)