4 ms·
The reason 256 bit AES keys are large enough is that in order to brute-force them, one of 2 things needs to happen: (1) We need to build computers out of somet
by casca 14y ago
The reason 256 bit AES keys are large enough is that in order to brute-force them, one of 2 things needs to happen:
(1) We need to build computers out of something other than matter
or
(2) A weakness in AES must be discovered that will need to reduce the search space significantly
We can disregard (1) as it will probably require changing (almost) all encryption algorithms that we currently use. (2) will most likely break all key-lengths so any use of AES will be weakened.
- tcoppi 14y agoInterestingly with regard to (2), there is actually a (totally impractical) attack on AES that only affects the larger key 192 and 256-bit versions and not 128-bit AES - http://eprint.iacr.org/2009/317 http://eprint.iacr.org/2009/317
- kzrdude 14y agoDoes that mean that AES-256 is 'broken' in crypto terms?
- debacle 14y agoNo.
- kzrdude 14y agoWikipedia _does_ put AES inside Category:Broken block ciphers.. "Widely cryptanalysed ciphers like Advanced Encryption Standard are considered stronger than un-cryptanalysed ciphers even if there are impractical attacks against them."
- finnw 14y agoIt means that if you generate a series of keys by simply incrementing a counter, your 192- and 256-bit keys will be cracked before my 128-bit key. But if you are generating keys that way, you should probably be more concerned about attacks against the RNG that generated the starting key.
- aw3c2 14y agoPeople often mention quantum computing will break all encryption. Would that be a non-matter computer?
- noselasd 14y agoThat's because quantum computers are still a pipe dream, so people assume it can do anything. Anyway, no - http://security.stackexchange.com/questions/25375/why-not-use-larger-cipher-keys http://security.stackexchange.com/questions/25375/why-not-us... tells us that you'd need the energy of all the output of our own sun for 32 years to even just count to 2^192
- Bakkot 14y agoQuantum computers have a fairly well-studied mathematical abstraction about which we can reason quite well. Algorithms for quantum computers exist which will break RSA; no similar algorithms exist to break AES. And the link actually only applies to traditional computers; quantum computers have no analogue of destructively setting a bit, because all operations on a quantum computer are fundamentally reversible, and hence do not entail any inherent energy loss to entropy.
- Devilboy 14y agoPublic key crypto schemes (RSA, elliptic curve etc.) are vulnerable to some variation of Shor's algorithm. We'll have to move to quantum crypto when this happens. Hell for all I know D-Wave's machines can already break RSA for the DHS. http://www.infosecisland.com/blogview/19707-The-Emerging-Threat-to-Public-Key-Encryption.html http://www.infosecisland.com/blogview/19707-The-Emerging-Thr... The 256 bit key size is still the recommended maximum since no increase will help against quantum computers.
- Scaevolus 14y agoNot all. Academics refer to it as "post-quantum cryptography", see http://pqcrypto.org/ http://pqcrypto.org/ From a talk by D. J. Bernstein http://cr.yp.to/talks/2008.10.18/slides.pdf http://cr.yp.to/talks/2008.10.18/slides.pdf : RSA: Dead. DSA: Dead. ECDSA: Dead. ECC in general: Dead. HECC in general: Dead. Buchmann–Williams: Dead. Class groups in general: Dead. Still alive: Hash-based cryptography. Example: 1979 Merkle hash-tree public-key signature system. Code-based cryptography. Example: 1978 McEliece hidden-Goppa-code public-key encryption system. Lattice-based cryptography. Example: 1998 “NTRU.” Multivariate-quadraticequations cryptography. Example: 1996 Patarin “HFE^V-” public-key signature system. Secret-key cryptography. Example: 1998 Daemen–Rijmen “Rijndael” cipher, aka “AES"