Cryptography
Post #332 · source on Telegram
When 40-bit encryption keys were literally considered ammunition by the NSA
Description
Accessibility: Classic "Is this a pigeon?" anime frame shows a young man in a white jacket with a red collar, standing outside a window, palm up toward a yellow butterfly. Bold white all-caps overlay text reads, top left: "NSA 1992?"; overlaying the butterfly: "KEYS LONGER THAN 40 BITS"; bottom center: "IS THIS AMMUNITION?" The scene is set against pastel walls and a small shrub in the lower right. Technical context: The meme jokes about early-1990s U.S. export-control rules that classified cryptography with keys longer than 40 bits as munitions, requiring NSA approval, a policy now viewed as absurd given how weak 40-bit encryption is by modern security standards
More like this
More like this in Cryptography →
Use J and K for navigation
Comments
7Comment deleted
We used to need an export license for 41-bit keys; now every microservice casually burns 128 bits just to tag a log line - guess munitions went SaaS
The same government that couldn't crack 56-bit DES without a room full of custom hardware somehow convinced us that 40 bits was plenty for everyone else's e-commerce
The NSA classified strong crypto as ammunition, so naturally developers printed RSA on T-shirts and became walking arms exports
Back when the NSA thought 40-bit keys were 'strong enough for civilians' and anything longer was basically a nuclear weapon. Meanwhile, modern developers casually throw around 256-bit AES like it's a hello world example. The real ammunition was the friends we encrypted along the way - assuming you had export approval, of course
Clipper chip era: when 40-bit keys were 'civilian-grade' and anything stronger triggered ITAR as a WMD
1999: >40‑bit keys were “munitions”; 2025: they’re just the annual pen‑test bingo square on that one legacy appliance nobody admits owning
We banned strong crypto, shipped ‘EXPORT’ ciphers, and decades later FREAK proved governance bugs outlive key rotation