A little trip down memory lane: In a meeting at the National Security Agency headquarters in November 2004, NIST representative Bill Burr told me that chances of finding an advocate of short (forty bit) keys in the Administration was about the same as finding Nazis in Germany in 1947. That's an oblique way of saying nobody will admit to it. But very short encryption keys were the order of the day for many years.
What's that all about? It's that longer encryption keys make it more difficult for hackers (or government agencies) to try every possible key in what is called a brute force attack. The current status: The Bureau of Industry and Security through its Export Administration Regulations still controls the export of symmetric keys that are longer than 64 bits. (Symmetric means that the person encrypting and the person decrypting both need to use the same key.)
What is the Bureau of Industry and Security telling us? That the easiest way to defeat brute force attacks is to use longer keys.
MarpX Privacy™ uses seven letter keys. That has the appearance of only 7 X 8 = 56 bits per key. Well, yes and no. Each letter maps to a key extender which is several hundred bytes long. The letter and the position among the seven letters is used to select each key extender. It's the bits and bytes among seven key extenders that control the actual process of making content private or of recovering the original content.
Extreme Encryption™ uses pre-selected batches of key extenders, instead of seven letter keys. A key extender batch is typically well over two thousand bytes long. We refer to these extender batches as one time keys, in the sense that any one key is used only once to encrypt (make private) one file or message, and used again only to recover the original content. How can a key be thrown away after only one use? Isn't that wasteful? Not really. There are more possible keys than there are particles in the universe.
Extreme Encryption™ is not for export. We also reserve the right not to sell this product to any group or persons within the United States whose name appears within an Export Administration Consolidated Screening List.
You will find some interesting calculations about trying to break an Extreme Encryption™ file or message in our discussion of quantum computer hacking. It can be summarized simply: Brute force attack on Extreme Encryption™? Forget about it. It is "computationally infeasible".
MarpX Privacy™ is a deliberately scaled down variation of the same technology. There are only eight billion unique keys (26 times itself seven times). This is vulnerable to brute force attacks, but only by an organization with incredibly high computing strength. The question is how much is your information (files or messages) worth to a person who might be interested? You can be pretty sure that app developers aren't going to try up to eight billion keys in order to read just one of your emails. See Tech’s 'Dirty Secret': The App Developers Sifting Through Your Gmail by Douglas MacMillan in the Wall Street Journal, July 2, 2018.
In other words, we have presented products that are scaled to the likelihood of someone valuing your information highly enough to spend heavily enough to decrypt it -- especially if you use a different key for each file and message. Your data may be interesting. But chances are that it's not that interesting!