2 ms·

AES as standard has only up to 256 bit keys, and I haven't followed closely what was going on in crypto lately. Which secure 512 or 1024 bit symmetric encrypti

• hannob 10y ago
  aes256 is fine. This is a bit different for block ciphers and hashes. The very brief / simplified explanation: Block ciphers have a security level of their key size, so aes256 has a prequantum security level of 256 bit, which means a postquantum security level of 128 bit. Hashes however have - due to the requirement for collision security and the birthday paradox - a security level half of their size. Therefore for 128 bit prequantum security you need a 256 bit hash and for 128 bit postquantum security you need a 512 bit hash.
• acqq 10y ago
  As far as I know, if you just use symmetric AES 256 it shouldn't be a problem for a while. The potential (I repeat that, see Aaronson's post I linked to earlier) problem is "just" the use of the public keys. And combining the lower-bit algorithms into the bigger ones is relatively easy, as an example from the 56-bit DES a 3DES with security of around 112 bits was made and (is still) used: https://en.wikipedia.org/wiki/Triple_DES https://en.wikipedia.org/wiki/Triple_DES edit: re: the early collisions with 64-bits etc: If I understand, the problem happens only when the soon-enough rekeying doesn't: https://sweet32.info/ https://sweet32.info/ I agree it's better to avoid these altogether.
  • CiPHPerCoder 10y ago
    But don't use 3DES, since the DES block size is 64 bits and you get collisions (e.g. in CBC mode) after 2^32 blocks.