A method developed by researchers at Bar-Ilan University turns storing the encryption formula itself into a valuable resource; even if the key is revealed in the future, an attacker who did not store enough information in advance will not be able to reconstruct the message.
The scenario that worries organizations that hold sensitive information is sometimes called "collect now, decrypt later": an attacker copies encrypted traffic today, stores it for years, and waits for the day when the key is leaked or computational power improves. Research by Prof. Eilon Yogev And the doctoral student Shani Ben-David From the Department of Computer Science and Artificial Intelligence atBar-Ilan University offers a way to reduce risk—not by guaranteeing that the key will never be revealed, but by making the guarding of the text of theEncryption All of this is a necessary condition for a future attack.
The researchers call the approach “incompressible encryption” with persistent security. The idea is simple to describe but not trivial to implement: If an attacker tries to compress the ciphertext to save storage space, he loses information essential for decryption. Even if he later obtains the secret key, the digest he has saved will not be enough to reconstruct the message.
Storage becomes part of the threat model
Most encryption models assume that an attacker can copy and store everything that passes over the network. In a world where data volumes are growing rapidly, this assumption is not always realistic. A complete snapshot of large-scale traffic requires years of storage, power, and maintenance. The new research turns this practical limitation into a formal element in the definition of security.
If, for example, the attacker is only able to store part of the ciphertext, the goal is to ensure that the stored part will not allow him to learn the message even after he gets the key. The researchers precisely define the attacker's maximum storage rate and prove security against it. They also present a rate-1 construction: the length of the ciphertext is almost the same as the length of the message, without much data inflation.
What has been proven—and what has not?
The main contribution is the proof of the existence of public-key cryptography with this property. The researchers show that encryption schemes with the appropriate level of security can serve as a basis for their construction, when the right security parameter is chosen. In addition, they propose a definition based on the storage rate, which allows analyzing how much of the encrypted information an attacker must keep in order not to lose the ability to decrypt in the future.
However, it is not "eternal encryption" in the absolute sense. If the attacker has saved the entire encryption formula, or enough of it according to the parameters of the system, a future key leak could still compromise the message. The method also does not eliminate the need for key management, algorithm switching, and endpoint protection. It adds a layer of defense against an adversary who is limited in storage at the time of reception.
This distinction is especially important in the face of quantum computing. The study does not claim that the construction is automatically immune to any future quantum computer. The proposed advantage stems from the fact that the attacker's decision on what to keep must be made before the key is revealed. If crucial information is lost at this stage, future computing power alone will not recover it.
Who might the approach be suitable for?
Uncompressed encryption may be particularly relevant for mass traffic and information whose value is preserved over time: medical records, government communications, research data, or trade secrets. The larger the amount of traffic and the longer it needs to be preserved, the more significant the attacker's storage limit becomes.
Real-world implementation will still require consideration of performance, parameters, and costs, as well as integration with existing standards and systems. The current study is primarily a theoretical result inCryptography: It formulates a security model and shows that it is possible to build a system that meets it.
Questions and Answers
Can the key be safely published after use?
Not in every situation. The promise only applies against an attacker who did not retain enough information about the encryption formula before revealing the key. An attacker who retained the necessary information could still decrypt it.
Does the method replace post-quantum encryption?
No. These are different layers of protection. Post-quantum encryption is designed to withstand quantum algorithms; incompressible encryption exploits a storage limit at the time the traffic is collected.
Why can't the encryption formula be compressed?
The cryptographic structure is designed so that trying to keep the representation too short will lose information needed for later decryption. This is a property of the mathematical construction, not a claim that any ordinary encrypted file is immune to compression.
The scientific article
More on the subject on the science website
- Any device built today that is not compatible with quantum encryption will be a Fritz
- Scientists from China: We cracked encryption using a quantum computer
- No more computer hacking—practical quantum encryption
- The 2025 Turing Award was awarded to Charles Bennett and Gilles Brassard for the foundations of quantum information science.
For the scientific article: Opening the scientific article
