3.4 Key length

The key space 𝒦 is large but finite. So, in principle, it is possible to search through it completely until the correct key K has been found. Such an attack is called a brute-force attack. Whether a brute-force attack is possible within a reasonable time frame, that is, within the time span the protected information is valuable for Eve, depends not only on the size of the key space but also on the speed of the latest computing technology and the resources Eve has at her disposal (this is part of the attacker model). This means key recommendations can (and do) vary over time.

For reasons of cost and usability, you should not always suppose the strongest possible attacker is after you. Thinking about the means an attacker realistically has at his or her disposal is part of the so-called attacker model in IT security. After that, you try to make your system secure against the specific type of attacker you have defined in your attacker model. When it comes to key length...