When someone says an encryption scheme is secure, what is the claim?

It sounds like a statement about the scheme. It is closer to a statement about us. Secure, in almost every case that matters, means that nobody has found a way to break it. Not that no way exists. That nobody has found one.

This is not pedantry. The gap between "cannot be broken" and "has not been broken" is where the entire field lives. Every migration, every deprecation, every quiet panic in cryptography comes out of that gap.

Two Kinds of Secure

Start with the one honest floor: brute force.

Take AES-128, the symmetric cipher that encrypts a large share of the world's data. Its key is 128 bits long. To break it by brute force you try keys until one works. There are 2^128 of them, a number with thirty-nine digits. No classical machine, now or in any plausible future, searches a space that size.

If the only attack were brute force, AES-128 would be secure in a strong, countable sense, and we could stop worrying.

Even here there is a caveat. A quantum computer running Grover's algorithm searches that space quadratically faster, which turns AES-128's 128 bits of security into about 64. That is why the post-quantum recommendation for symmetric encryption is not a new algorithm but a bigger key, AES-256. Grover weakens brute force. It does not break it.

The real problem is that brute force is the floor, not the ceiling, of what an attacker can try. A cipher is only as strong as the best attack against it, and the best attack is almost never brute force. It is a shortcut. And shortcuts are exactly the thing we cannot rule out.

The Part We Cannot Prove

Here is the uncomfortable center of the subject. Nobody has proven that RSA or any other encryption scheme is hard to break.

RSA rests on the belief that factoring a large number into its primes is hard. There is no theorem that says so. The best known factoring algorithm is slow, but "best known" is carrying enormous weight in that sentence. Nothing in mathematics guarantees that a faster one does not exist, sitting undiscovered in a paper nobody has written yet.

So what actually justifies trusting RSA? Time. Decades of capable people trying to factor efficiently and failing. That failure is the security. Not a proof. A record.

This is an epistemic claim wearing the costume of an ontological one. We say "factoring is hard" as though we were describing a property of numbers. We are describing the current limit of human knowledge about numbers. When you trust RSA, you are trusting the absence of an idea.

Provably Secure, and Nearly Useless

There is one exception. One scheme we can actually prove is unbreakable.

It is the one-time pad. You take a key that is truly random and exactly as long as your message, and you combine it with the message bit by bit. Claude Shannon proved, in the middle of the last century, that the result leaks nothing. An attacker with infinite computing power and infinite time learns nothing about the message beyond its length. This is not "hard to break." It is impossible to break, and we can prove it.

So why is almost nothing encrypted this way?

Because security is not the only requirement. The one-time pad's key must be as long as everything you will ever send, must be perfectly random, must never be reused, and must reach the other party through some channel that is already secure. If you had a secure channel for a key that large, you could have sent the message through it instead. The cipher is perfect and, for almost every real use, pointless.

This is the trade the whole field is built on. We give up provable security, which we can have but cannot use, in exchange for practical security, which we can use but cannot prove. Convenience is not a luxury bolted onto cryptography. It is half the problem.

When the Ground Moves

If security is only the absence of a known attack, then a new attack does not merely weaken a scheme. It can erase it.

This is what quantum computing did to RSA and elliptic-curve cryptography. Nobody found a flaw in them in the ordinary sense. What happened is that Peter Shor, in 1994, described an algorithm that factors and computes discrete logarithms efficiently on a quantum computer. The assumption underneath RSA and ECC, that these problems are hard, was quietly conditional the whole time. It was hard for classical computers. Against a machine running Shor's algorithm, it is not hard at all.

Both schemes are now being deprecated worldwide. Not because anyone factored a real key, but because the assumption that protects them became indefensible the moment a new model of computation was on the table. Classical cryptanalysis had no reason to look in that direction. The attack came from a place the defenders were not defending.

SIKE, and Why the Test of Time Is the Ultimate Test

The instinct after Shor is to reach for something new and quantum-resistant. Reasonable. But new is exactly the property that should make you nervous, and there is a recent lesson.

SIKE was a post-quantum candidate in the international competition to replace RSA and ECC. It was based on isogenies between elliptic curves, it had unusually small keys, and it survived several rounds of scrutiny. Then, in the summer of 2022, two researchers published an attack that recovered its secret key in about an hour, on a single-core computer.

Not a quantum attack. An ordinary one. A scheme built to resist the most powerful computers imaginable was destroyed by one of the weakest, using a piece of mathematics nobody had thought to aim at it. SIKE was withdrawn.

This is why the test of time is not a bureaucratic delay or a ritual of caution. It is the security mechanism itself. An algorithm earns trust in proportion to how long it has stood while smart, motivated people tried to break it. A young algorithm has not earned that trust, however elegant its design. It has only not been broken yet, which, as we have seen, is a different thing.

The Honest Posture

We can prove security only in the two cases that help us least: the size of a keyspace against brute force, and the one-time pad we cannot practically deploy. Everything else, every padlock in every browser, is protected by the failure of everyone who has tried to break it so far. That failure is real evidence. It is not a proof.

Cryptography is not the science of building unbreakable locks. It is the science of building locks that have not been picked, watching them closely, and being ready to swap them the moment someone finds the pick. "Secure" is written in the present perfect tense. It always has been.