2 ms·
It's indeed a potential concern, basically the quantum edition of the Sweet32 attack. History will repeat itself (Although I wonder how much pre-quantum AES-256
by segfaultbuserr 6y ago
It's indeed a potential concern, basically the quantum edition of the Sweet32 attack. History will repeat itself (Although I wonder how much pre-quantum AES-256 traffic will really be vulnerable in practice. I think an interactive attack will be very unlikely, the concern is mostly pre-existing ciphertext. I guess most OpenPGP traffic will probably be secure? And even HTTPS will be okayish as long as you don't send too much data in a single connection? It would be an interesting study...) Fortunately, start using ChaCha20 or XChaCha20 is easy, unlike inventing and deploying a new public-key cryptosystem. So symmetric ciphers are still an "easy" problem.
[0] https://sweet32.info/ https://sweet32.info/
- dogma1138 6y agoHistoric traffic isn’t going to be much of an issue at all, as for AES-GCM specifically then nonce reuse will still likely be an issue well before a QSweet32 attack will be. As for ChaCha et al, it’s still not that easy to start using it. Not that many proven standardized implementations exist, hardware acceleration and performance issue are still there, the amount of research on these ciphers is still dwarfed by the amount of research done against AES and since these aren’t industry standards it’s harder to implement them in systems that require wide interoperability and are pretty much a no go in any industry that has its own standards. Using extended ChaCha is cool for your side project, but try to implement it to say protect card payments in a system that needs to go through a PCI certification for example.