next up previous
Next: Capability of attackers Up: No Title Previous: Order of introducing encryption

Strength of Encryption Mechanisms

According to present government guidelines, information whose compromise could threaten human life directly must be classified `Secret'; there are certainly medical records that fall in this category. Yet the Red Pike algorithm which the NHS strategy recommends (and which is being used in the Teesside pilot) is only evaluated to `Restricted' -- two whole grades below. As its keys are only 64 bits long, it is already vulnerable to keysearch by large organisations, and will be open to attack by individuals within 10-15 years at most. The NHS Executive's own documents estimate the life of Red Pike at only five years. In addition, it does not command the confidence of the cryptographic community. It is worth while discussing these points in more detail.

Ross Anderson
Mon Oct 6 12:47:34 BST 1997