> The article is just simply mistaken about the intractability, the current existence of computation at a scale it claimed would take ten thousand years shows i

> The article is just simply mistaken about the intractability, the current existence of computation at a scale it claimed would take ten thousand years shows it nicely Well yeah, the article might be wrong about how untractable it is, but that doesn't mean it is tractable. Even when taking the minimum annual electricity consumption of the Bitcoin network (41.31TWH/yr) and assuming the Bitcoin network did all those hashes in the last year and assuming that a 2^100 attack on AES-128 exists (which it doesn't), you'll still need an absurd amount of energy just to crack a single key. > setting parameters conservatively My argument is that for almost all applications key lengths of 128 bits are pretty conservative. AES-128 will not be the weak link in your application, bad usage of cryptography, memory leaks, use-after-free vulnerabilities, users just doing stupid things, 0-days in your operating system of choice are all easier to exploit than cracking a single AES-128 key. That said, you probably shouldn't use AES-128 if your threat model includes a intelligence agency 50 years into the future. In that case AES-256 will not help you either.