4 ms·

Are you saying there is no encryption guaranteed to be good for the next 50 years ?

by fouc 5y ago

brutus1213 5y ago
Against a state-actor, perhaps not. Check out quantum cryptography. It is a serious business.
- pseudo0 5y ago
  The current academic consensus is that AES-256 is quantum resistant, as even with Grover's algorithm the attack would still require 2^128 bits of work. Generally symmetric encryption schemes are impacted to a much lesser extent than public key cryptosystems, with larger key sizes sufficing to ensure quantum resistance. I'd be quite surprised if Apple weren't using AES-256 already.
  - eurasiantiger 5y ago
    They are using AES-128. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
    - pseudo0 5y ago
      A minimum of AES-128, which could mean 100% AES-128 or 1% AES-128 from old iOS devices that haven't been updated in years. And even AES-128 would require doing a 2^64 exhaust on a quantum computer, which would be quite a remarkable feat.
      - eurasiantiger 5y ago
        More likely it’s all AES-128 since that is natively supported by energy-efficient TPM chips, while -256 isn’t.
- CodesInChaos 5y ago
  Quantum cryptography is much less convenient than conventional asymmetric cryptography and offers few benefits. Doesn't stop people from trying to sell it though... And for the "encrypted data at rest" scenario we're talking about here, where symmetric encryption suffices, quantum crypto makes no sense what-so-ever.
occamrazor 5y ago
Of course there is no guarantee: AES256 could be broken tomorrow, or maybe it has already been. What we know is that, extrapolating compute speed from the past decades and even assuming quantum computers become useable in practice, the best algorithms we currently have cannot be brute-forced within the next 50 years.
- lxgr 5y ago
  > AES256 could be broken tomorrow, or maybe it has already been. This is extremely unlikely. > What we know is that, extrapolating compute speed from the past decades and even assuming quantum computers become useable in practice, the best algorithms we currently have cannot be brute-forced within the next 50 years. Quantum computers only offer a quadratic speedup against symmetric ciphers. AES 256 will survive much longer than the next 50 years against brute force attacks. It will either be broken spectacularly, using theoretical methods entirely inconceivable today, or live on – brute force is of no concern at all due to the amounts of energy and matter required to perform it against 256 bit keys.
  - gambiting 5y ago
    >>AES 256 will survive much longer than the next 50 years against brute force attacks. From what I understand it simply can't be broken by brute force because simply iterating through every possible value of a 256 bit key would require more energy than there is in the universe, and that's without actually trying any of the combinations, just simply having a computer do a i++ through all possible values. I'm not sure if quantum computing helps here in any way , someone else would need to chime in here with details.
    - CodesInChaos 5y ago
      > I'm not sure if quantum computing helps here in any way Theoretically a quantum computer can brute-force AES-256 using 2^128 sequential steps using Grover's algorithm (i.e. a quadratic advantage over a classical computer). Parallelization diminishes the advantage, e.g. if you're limited to 2^64 sequential steps, you get a 2^64 speedup over classical, for a cost of 2^192 which is still ridiculously large. Thus quantum computing is not a relevant threat for AES-256 or most other 256-bit symmetric crypto.

Are you saying there is no encryption guaranteed to be good for the next 50 years ?

by fouc 5y ago

Are you saying there is no encryption guaranteed to be good for the next 50 years ?

brutus1213 5y ago

Against a state-actor, perhaps not. Check out quantum cryptography. It is a serious business.

pseudo0 5y ago
The current academic consensus is that AES-256 is quantum resistant, as even with Grover's algorithm the attack would still require 2^128 bits of work. Generally symmetric encryption schemes are impacted to a much lesser extent than public key cryptosystems, with larger key sizes sufficing to ensure quantum resistance. I'd be quite surprised if Apple weren't using AES-256 already.
- eurasiantiger 5y ago
  They are using AES-128. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
  - pseudo0 5y ago
    A minimum of AES-128, which could mean 100% AES-128 or 1% AES-128 from old iOS devices that haven't been updated in years. And even AES-128 would require doing a 2^64 exhaust on a quantum computer, which would be quite a remarkable feat.
    - eurasiantiger 5y ago
      More likely it’s all AES-128 since that is natively supported by energy-efficient TPM chips, while -256 isn’t.
CodesInChaos 5y ago
Quantum cryptography is much less convenient than conventional asymmetric cryptography and offers few benefits. Doesn't stop people from trying to sell it though... And for the "encrypted data at rest" scenario we're talking about here, where symmetric encryption suffices, quantum crypto makes no sense what-so-ever.

occamrazor 5y ago

Of course there is no guarantee: AES256 could be broken tomorrow, or maybe it has already been. What we know is that, extrapolating compute speed from the past decades and even assuming quantum computers become useable in practice, the best algorithms we currently have cannot be brute-forced within the next 50 years.

lxgr 5y ago
> AES256 could be broken tomorrow, or maybe it has already been. This is extremely unlikely. > What we know is that, extrapolating compute speed from the past decades and even assuming quantum computers become useable in practice, the best algorithms we currently have cannot be brute-forced within the next 50 years. Quantum computers only offer a quadratic speedup against symmetric ciphers. AES 256 will survive much longer than the next 50 years against brute force attacks. It will either be broken spectacularly, using theoretical methods entirely inconceivable today, or live on – brute force is of no concern at all due to the amounts of energy and matter required to perform it against 256 bit keys.
- gambiting 5y ago
  >>AES 256 will survive much longer than the next 50 years against brute force attacks. From what I understand it simply can't be broken by brute force because simply iterating through every possible value of a 256 bit key would require more energy than there is in the universe, and that's without actually trying any of the combinations, just simply having a computer do a i++ through all possible values. I'm not sure if quantum computing helps here in any way , someone else would need to chime in here with details.
  - CodesInChaos 5y ago
    > I'm not sure if quantum computing helps here in any way Theoretically a quantum computer can brute-force AES-256 using 2^128 sequential steps using Grover's algorithm (i.e. a quadratic advantage over a classical computer). Parallelization diminishes the advantage, e.g. if you're limited to 2^64 sequential steps, you get a 2^64 speedup over classical, for a cost of 2^192 which is still ridiculously large. Thus quantum computing is not a relevant threat for AES-256 or most other 256-bit symmetric crypto.