4 ms·
256 bits is stronger than 128 bits and the extra cost does not matter for a tool designed to encrypt files. It also saves a lot of time answering questions and
by mytailorisrich 4y ago
256 bits is stronger than 128 bits and the extra cost does not matter for a tool designed to encrypt files.
It also saves a lot of time answering questions and justifying the choice.
So, IMHO, go for 256 bits and be done with it.
- tptacek 4y agoNo, you can't really win here. If you reflexively bring your symmetric constructions to 256 bits, you end up in equally unproductive arguments about parity with your asymmetric constructions.
- loup-vaillant 4y agoIn my experience, much fewer people object to the use of Curve25519 than they do about 128-bit symmetric keys. I believe one reason is that bigger curves have a significantly higher cost, while limiting symmetric encryption strength to 128 saves zero CPU cycles with Chacha20. For the few who do object, explaining that there is no such thing such as parity between symmetric and asymmetric primitive can help: https://loup-vaillant.fr/tutorials/128-bits-of-security https://loup-vaillant.fr/tutorials/128-bits-of-security
- tptacek 4y agoI'm responding to a comment suggesting that designers elect for 128 bit primitives to head off unproductive debates. Suggesting that you have a strong preprepared answer for those debates isn't really responsive to what I'm saying.
- loup-vaillant 4y agoSorry, I didn't mean to convey a strong disagreement here. I mostly agree with you on this. Besides, we know the next step: use Curve448 to stave off criticism about using a small curve, and then people start talking quantum computers.
- mytailorisrich 4y agoYes, everyone will immediately pick on 128 bits for symmetric encryption but I suspect the vast majority of people won't pick on the fact that Curve25519 offers less bits of strength than 256 bits symmetric encryption, or they won't care. So you'll still avoid a lot of questions and have a better marketing box-ticking scorecard, will probably still be more secure.
- vbezhenar 4y ago2560 bits is stronger than 256 bits and the extra cost does not matter for a tool designed to encrypt files. See what I did here? Where do we stop?
- mytailorisrich 4y agoThis is absurd. I am only comparing the two main options (more or less) for symmetric encryption: 128 or 256. Edited as not AES but you get the point taking into account that AES256 is the standard.
- tptacek 4y agoAge doesn't use AES.
- loup-vaillant 4y agoWe stop before the key is big enough to requires the energy of our sun to crack, even if you have an ideal computer. 256-bit keys require more energy than a nova. 128 bits however is humanly achievable (35 years worth of peak Bitcoin mining), and as such perhaps a tad low in really high stakes scenarios (say highly classified stuff). We could chose something between 128 and 256, but they're nice powers of two, and we tend to like powers of two.
- upofadown 4y agoI got billions of years when I used the current bitcoin hashing rate for 128 bits. Are you assuming a birthday attack?
- loup-vaillant 4y agoNo, I just botched it and pretended 2^35 = 35. See these other comments for more details: https://news.ycombinator.com/item?id=34955855 https://news.ycombinator.com/item?id=34955855 https://news.ycombinator.com/item?id=34963094 https://news.ycombinator.com/item?id=34963094
- 4y ago