I just read the article written by Bruce Schneier, the crypto guru. In the article, he says :
Prefer symmetric cryptography over public-key cryptography.
But, he doesn't shed any light as to why.
Now, I thought that public key systems avoid problems with some man in the middle attacks & key distribution which are the problems with symmetric key cryptography, right?
Can anybody please explain Bruce Schneier's view or am I missing something?
This preference of symmetric cryptography over asymmetric cryptography is based on the idea that asymmetric cryptography uses parametrized mathematical objects and there is a suspicion that such parameters could be specially chosen to make the system weak. For instance, when using Diffie-Hellman, DSA or ElGamal, you have to work modulo a big prime p. A randomly chosen prime p will be fine, but it is possible to select a special p which will "look fine" but will allow easy (or easier) breakage of the algorithms for whoever knows how that special p value was generated. Such primes p which make crypto weak are very rare so you won't hit one out of bad luck (as I say, a randomly chosen prime will be fine).
This means that good cryptographic parameters are nothing up my sleeve numbers. If you look at FIPS 186-4 (the standard for DSA), you will see a description of a generation system for DSA parameters (namely, the big modulus p, and the generator g and group order q) which is demonstrably non-malicious. This works simply by showing the deterministic PRNG which presided to the generation of these values; by revealing the seed, you can show that you produced the parameters faithfully, and thus did not indulge in "special prime crafting".
A jib can be made against the standard NIST elliptic curves (see FIPS 186-4 again) because these curves again have some parameters, and NIST forgot to use a deterministic PRNG as described above (actually, NIST is not at fault here; these curves were inherited from SEC, so the mistake was probably Certicom's). The Brainpool curves attempt to fix that mistake. (Note that among the 15 NIST curves, at least the 5 "Koblitz curves" cannot have been deliberately weakened since there is no random parameter in them at all.)
Ole' Bruce turns all of the above into a generic anathema against asymmetric cryptography because he wanted a punchy line, not a more correct but lengthy explanation on group parameter validation, as described above. The lesson to remember is that the complete design of any cryptographic system shall be as transparent as possible, and this includes the generation of "seemingly random" parameters.
According to what he says, companies subtly change their products in undetectable ways for back doors. About public-key systems, he mentions adding a common exponent to a public-key exchange protocol.
... making the random number generator less random, leaking the key somehow, adding a common exponent to a public-key exchange protocol, and so on.
Perhaps, he thinks public-key cryptography is more open to manupulation than symmetric cryptography.
Schneier's blog has a couple of clarifying statements:
It is more likely that the NSA has some fundamental mathematical advance in breaking public-key algorithms than symmetric algorithms.
and
I personally am concerned about any constant whose origins I don't personally trust.
The justification of the former statement of course is very complex and relies to an extent on intuition/experience concerning the state of the art in mathematics. The latter is a more straightforward statement that certain systems have been more prone to NSA influence than others, and echoes the (probably controversial) statement from the article, "Prefer conventional discrete-log-based systems over elliptic-curve systems; the latter have constants that the NSA influences when they can".
Also bear in mind that the article is intended to present rules of thumb for a Guardian-reading audience. Of course there exist symmetric algorithms that the NSA is likely to have broken (or that are known to be breakable by the NSA), and asymmetric algorithms with no untrustworthy constants. He's not saying prefer a Caesar shift to DSA. But in Schneier's view the standard symmetric algorithms are more trustworthy than the standard asymmetric algorithms.
I believe you're correct that the increased difficulty of key distribution might mean that for many purposes a preference for symmetric crypto will not translate into actually being able to use it. He's probably mostly thinking about how you should communicate with friends/colleagues/co-conspirators, since those are the circumstances where the average user has a free choice of algorithms. No doubt his advice to those designing full crypto-systems would be more complex.
Finally note that all of this advice is specifically about NSA surveillance. If you do not regard the NSA (or its allies) as your adversary then it is not necessarily relevant, although much of it is good advice anyway. A typical hacker has a more limited set of available attacks.
I can only guess, but I think it may derive from a sense that asymmetric encryption is just more mathematically shaky than symmetric.
For instance, secure symmetric cryptography is known to be theoretically possible: Consider for instance the one time pad, which can even sometimes be used in practice. Standard symmetric ciphers are in a way a scheme for emulating this but with shorter keys (especially if you consider e.g. CTR mode).
Then consider the case of any asymmetric system. Here you need it to be mathematically possible to have a mathematical function F(secret-to-protect, pub key) that produces an encrypted result that cannot be used to infer secret-to-protect even if pub key is known to the attacker. I.e. you don't have any secret argument the function can use for protecting the secret (as is the case for the symmetric scheme) - the only thing that is secret is what you want to protect! Still the function must be bijective since otherwise the intended recipient can't decrypt it. So all the information must be there. Indeed, it must be computationally easy to reverse the operation knowing some extra information related to the public key, namely the private key. It is much less clear that such functions exist - it is not known that they do. RSA and ECC are essentially proposals for such a scheme - but only proposals since they are not proven secure. Establishing the security of any asymmetric scheme, would by implication establish P != NP, and hence seems to be a very difficult problem.
So given that no known instance of a secure asymmetric scheme is known (and indeed an asymmetric scheme must satisfy some much more difficult mathematical properties than the symmetric scheme), but given that secure examples are known of symmetric schemes, then all else being equal, it is reasonable to be more suspicious of asymmetric schemes.
From a practical point of view, it seems that the complexity of factorization and the discrete log problem (as employed in asymmetric ciphers) is reduced year by year (even though the best algorithms are still exponential in time) whereas AES and DES (almost) are holding their ground. The biggest problem with DES was the small key size, not that the algorithm was cracked. 3DES is still secure, but quite slow compared to AES.
Public key cryptography uses two keys and has huge mathematical complexity as a result of which computer gets slow when encryption and decryption for large data is to be done.
