Theory Layer
Key Size Uncertainties (1977-1985)
- No consensus on safe key lengths; initial 512-bit keys seemed sufficient but proved vulnerable
- Factorization algorithm advances (quadratic sieve, 1981) constantly moving the goalposts
- Lack of rigorous security proofs linking RSA hardness to factorization problem
Random Number Generation
- Cryptographically secure PRNGs weren't well-understood
- Most systems used weak randomness (timestamps, PIDs), making keys predictable
Mathematical Prerequisites
- Required understanding of modular arithmetic, Fermat's Little Theorem
- Limited educational materials for implementers
Protocol Layer
No Standard Protocol (1977-1991)
- RSA invented in 1977, but PGP not released until 1991
- SSL/TLS didn't exist until 1994-1995
- Each implementer created incompatible systems
Key Distribution Problem
- Public key infrastructure (PKI) didn't exist
- No trusted way to verify public key authenticity
- "Man-in-the-middle" attacks not well understood or prevented
Hybrid Encryption Not Obvious
- Early implementations tried to encrypt everything with RSA (too slow)
- The pattern of RSA for key exchange + symmetric for data took years to standardize
Communication Layer
Bandwidth Limitations
- 300-2400 baud modems (1970s-1980s)
- RSA ciphertext expansion made messages larger
- Email size limits on many systems
Store-and-Forward Networks
- UUCP, FidoNet operated on batch delays
- No real-time key negotiation possible
- Messages might take days to route
Infrastructure Layer
Computational Bottlenecks (Critical)
- CPU Speed: 1 MHz - 25 MHz processors (1977-1990)
- RSA encryption on an IBM PC (4.77 MHz, 1981) took ~1-2 seconds per operation for 512-bit keys
- Servers couldn't handle multiple simultaneous encryption operations
Memory Constraints
- 64KB-640KB RAM typical in early PCs
- Large key operations required significant memory
- No hardware acceleration existed
Lack of Cryptographic Accelerators
- All operations in software on general-purpose CPUs
- No dedicated crypto chips until late 1980s
- Big integer arithmetic libraries were primitive
Application Layer
No User-Friendly Software (1977-1990)
- Command-line tools only
- Required technical expertise to compile and use
- PGP (1991) was first widely-accessible tool, but still complex
Integration Challenges
- Email clients had no built-in encryption
- Applications needed custom crypto code for each platform
- No standardized APIs or libraries
Key Management Nightmare
- Users had to manually manage key files
- No password managers or secure storage
- Easy to lose private keys permanently
Frontend/UX Layer
Horrific User Experience
- Text-based interfaces requiring hex key fingerprints
- Users had to understand concepts like "sign" vs "encrypt"
- No visual indicators of security status
Key Exchange Ceremonies
- Users needed to verify fingerprints via phone (reading 32-64 hex characters)
- In-person key exchange parties common among security community
- High barrier prevented mainstream adoption
Error Messages
- Cryptic errors like "bad signature" with no explanation
- No recovery mechanisms for common mistakes
- Lost keys = lost data forever
Society/Cultural Layer
Cryptography = Espionage Association
- Public perception: "only spies and criminals need encryption"
- Legitimate users feared looking suspicious
- "If you have nothing to hide..." argument prevalent
Lack of Awareness
- Most people didn't understand privacy threats
- Email perceived as "private enough" without encryption
- No major data breaches yet to drive awareness
Tech Community Skepticism
- "Security through obscurity" still common
- Many didn't trust theoretical security vs physical security
- "Who would want to read MY email?" attitude
Legal/Regulatory Layer
Export Controls (ITAR/EAR) - MAJOR BOTTLENECK
- RSA classified as munitions under ITAR until 1996
- Exporting encryption software was illegal (felony)
- Even publishing source code could violate export law
- Phil Zimmermann faced grand jury investigation for PGP (1993-1996)
Patent Restrictions (1977-2000)
- RSA patented by MIT (US Patent 4,405,829)
- Licensing fees required for commercial use
- Created alternative systems (patent-free software like PGP used RSA anyway, creating legal ambiguity)
- Patent didn't expire until September 2000
Key Escrow Proposals
- Clipper Chip initiative (1993) - government-escrowed encryption
- Attempts to ban non-escrowed encryption
- Crypto Wars (1990s) - government vs privacy advocates
No Legal Framework
- Unclear if encrypted communications were legally protected
- Questions about law enforcement access
- No standards for lawful interception
The Critical Bottleneck Timeline
1977-1991: Computational + No Software
1991-1996: Legal Export Controls + Patent (despite PGP release)
1996-2000: Patent + Infrastructure scaling
2000+: Mainstreaming begins as patents expire, browsers add SSL/TLS
The computational bottleneck was overcome by Moore's Law, the legal bottleneck by advocacy and export control relaxation in 1996-2000, and the usability bottleneck by browser integration of SSL/TLS which hid complexity from users.