AES has been broken for over a decade. 256 bit AES is actually only 255 bits strong. It has not progressed any further, and AES is the most popular algorithm gl

AES has been broken for over a decade. 256 bit AES is actually only 255 bits strong. It has not progressed any further, and AES is the most popular algorithm globally and has had over two decades of eyes on it. This definitely is not generally true, especially for “academic breaks” that don’t even approach feasibility. I really think security people fear the wrong things. Unless they are fundamentally flawed very few actual crypto breaks happen in practice. Most real world breaks are the result of implementation bugs, side channel attacks, and social engineering. If I had to choose between a buggy code base implementing Noise with the latest hipster crypto and a well written memory safe audited code base and protocol using RSA-1024 and RC4, I would feel safer with the latter. (Unless my adversary were the NSA or someone else at that level, in which case I would layer three or four systems for defense in depth.) This is not an argument for the use of weak crypto. It’s an argument for fearing the implementation, deployment, and users more than the crypto. Big blobs of C are scary regardless of what they implement, especially if they are messy and have not had many eyes on them. The meat bag in front of the computer is usually the least secure component. If you look at real world breaks it’s usually bad opsec or phishing. The hipsterest crypto won’t help you if you are tricked into running malware or you have an insecure PHP script on a web server.