3 ms·

You're not wrong. I wouldn't count on AES-128 staying secure for all of eternity, but I don't like they way you say > just by bitcoin mining like the bitcoin

You're not wrong. I wouldn't count on AES-128 staying secure for all of eternity, but I don't like they way you say > just by bitcoin mining like the bitcoin network is a small hobby project in someones basement. The bitcoin network has the same annual energy footprint as the country of Austria. The truth is that even with a purely hypothetical 2^100 attack on AES-128 the NSA wouldn't be able to crack a single key even if all of their funds would go directly into paying for electricity.

nullc 7y ago
The energy calculations for bitcoin usually range between wrong and absurdly and painfully wrong. Expenditures on the mining are bounded on the upper end by the income, which sets a current ceiling at about $13 million USD per day. In practice actual expenditures are a fraction of that upper bound, since the hardware still needs to be paid for an it wouldn't be worth doing without a profit. Bitcoin's energy usage level (even the high upper bound) of expenditure is within the estimates of the NSA's budget (10.8billion usd/yr est in 2013). The Manhattan Project had an estimated cost of $23 billion (2018) dollars. If we take the article's target of 2^80 operations (for a one in a million against a 2^100 expected attack), and assume those operations are as efficient as bitcoin miners do sha256(sha256()) -- 0.075J/billion ops. And then we assume you pay 2.5cts per KWH for power (an industrially available rate in low power cost areas of the US) --- that attack would cost $629648 in power. I bet the US has single munitions that cost almost much. The article is just simply mistaken about the intractability, the current existence of computation at a scale it claimed would take ten thousand years shows it nicely-- it doesn't matter that the computation has indeed, been pretty costly. This makes another argument for setting parameters conservatively: order of magnitude errors in attack costs are less likely to be fatal if you do!
- muldvarp 7y ago
  > The article is just simply mistaken about the intractability, the current existence of computation at a scale it claimed would take ten thousand years shows it nicely Well yeah, the article might be wrong about how untractable it is, but that doesn't mean it is tractable. Even when taking the minimum annual electricity consumption of the Bitcoin network (41.31TWH/yr) and assuming the Bitcoin network did all those hashes in the last year and assuming that a 2^100 attack on AES-128 exists (which it doesn't), you'll still need an absurd amount of energy just to crack a single key. > setting parameters conservatively My argument is that for almost all applications key lengths of 128 bits are pretty conservative. AES-128 will not be the weak link in your application, bad usage of cryptography, memory leaks, use-after-free vulnerabilities, users just doing stupid things, 0-days in your operating system of choice are all easier to exploit than cracking a single AES-128 key. That said, you probably shouldn't use AES-128 if your threat model includes a intelligence agency 50 years into the future. In that case AES-256 will not help you either.

nullc 7y ago

The energy calculations for bitcoin usually range between wrong and absurdly and painfully wrong. Expenditures on the mining are bounded on the upper end by the income, which sets a current ceiling at about $13 million USD per day. In practice actual expenditures are a fraction of that upper bound, since the hardware still needs to be paid for an it wouldn't be worth doing without a profit. Bitcoin's energy usage level (even the high upper bound) of expenditure is within the estimates of the NSA's budget (10.8billion usd/yr est in 2013). The Manhattan Project had an estimated cost of $23 billion (2018) dollars. If we take the article's target of 2^80 operations (for a one in a million against a 2^100 expected attack), and assume those operations are as efficient as bitcoin miners do sha256(sha256()) -- 0.075J/billion ops. And then we assume you pay 2.5cts per KWH for power (an industrially available rate in low power cost areas of the US) --- that attack would cost $629648 in power. I bet the US has single munitions that cost almost much. The article is just simply mistaken about the intractability, the current existence of computation at a scale it claimed would take ten thousand years shows it nicely-- it doesn't matter that the computation has indeed, been pretty costly. This makes another argument for setting parameters conservatively: order of magnitude errors in attack costs are less likely to be fatal if you do!

muldvarp 7y ago
> The article is just simply mistaken about the intractability, the current existence of computation at a scale it claimed would take ten thousand years shows it nicely Well yeah, the article might be wrong about how untractable it is, but that doesn't mean it is tractable. Even when taking the minimum annual electricity consumption of the Bitcoin network (41.31TWH/yr) and assuming the Bitcoin network did all those hashes in the last year and assuming that a 2^100 attack on AES-128 exists (which it doesn't), you'll still need an absurd amount of energy just to crack a single key. > setting parameters conservatively My argument is that for almost all applications key lengths of 128 bits are pretty conservative. AES-128 will not be the weak link in your application, bad usage of cryptography, memory leaks, use-after-free vulnerabilities, users just doing stupid things, 0-days in your operating system of choice are all easier to exploit than cracking a single AES-128 key. That said, you probably shouldn't use AES-128 if your threat model includes a intelligence agency 50 years into the future. In that case AES-256 will not help you either.