Obama Eyeing Internet ID for Americans

[stevenleser]

112. Well, for starters...

any kind of ID system proposed like this has relied on Public/Private key authentication/encryption. http://en.wikipedia.org/wiki/Public-key_cryptography

These have generally worked because they can implement very hard to break encryption to the order of 256 bits of passwords and the keys being passed back and forth. See this brief discussion on passwords and encryption http://en.wikipedia.org/wiki/Password_strength#Bit_strength_threshold

It was thought that encryption of passwords, keys and other items done with 128bit or the higher 256bit would for all practical intents and purposes be unbreakable.

Enter the GPU. http://en.wikipedia.org/wiki/Graphics_processing_unit
Most computers have graphics processing units to handle the graphics displays and offload this task from the main CPU. It turns out that these processors are great for breaking encryption and there is ready made software out there to turn GPU's into codebreakers capable of breaking 128 and 256 bit encryption schemes in surprisingly short amounts of time. For an example, see http://www.pcpro.co.uk/blogs/2011/06/01/how-a-cheap-graphics-card-could-crack-your-password-in-under-a-second/ and http://www.elcomsoft.com/edpr.html

So any ID system, which would essentially be a large store of encrypted public/private keys would be a juicy target for any jerk with a small farm of GPUs. I've simplified it a bit so that non-techies would have a chance to understand it, but the point is the same. Any system like this would be vulnerable on day 1.