Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've read almost everywhere that AES-256 can be used for Top Secret material (in the US). Is it really used or is it some kind of decoy to hide the more advanced algorithm they might use ?

share|improve this question
I would recommend googling "Suite A" cryptography, which is apparently a suite of ciphers the NSA may elect to use instead of "Suite B" (which includes AES). For a discussion of that, see this question on – Reid May 4 '13 at 17:18
up vote 7 down vote accepted

Decoy for whom?

Security, and cryptography specifically, has a need for public scrutiny. It's been proven time and time again that hiding the nature of the protocol/algorithm/scheme doesn't provide any tangible security. Kerckhoffs' principle explains this: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

It's "secure" up until someone finds out how it works and breaks it. Publically reviewed algorithms are something that people are always trying to break. The more people that try (and fail) to break something, the better that something is. This is important because it's really difficult to design crypto properly.

To answer your question specifically: Yes, AES is used for classified materials. Other algorithms are also used depending on the nature and use of the data.

A quick Google search came back with this PDF doc from NIST: Guideline for Implementing Cryptography In the Federal Government. It may be out of date, or there may be better documents, but it's an enlightening read.

share|improve this answer
Do you really think they are telling what tools they are using, especially for top secret? And GPGPU clusters bought by China or Russia, don't you think they can break AES ? Here are two questions I think interesting. I'm more the science (and crypto) guy than the conspiracy theorist/terrorist but these questions are worth asking and answering for good. – Romain May 4 '13 at 9:10
@Romain Unless they have found a cryptanalytic attack on AES, no amount of GPU clusters will succeed at brute forcing AES with our current understanding of information theory. As far as we can tell, AES is strong when used properly. Whether governments or secret agencies use something else is by definition pure speculation and somewhat off-topic. – Thomas May 4 '13 at 11:42

Your question might be missing one plausible reason for governments to keep certain aspects of their cryptographic systems secret (besides the key), namely that their interest in learning the secrets of the opposition, might be as strong as their interest in keeping their own secrets to themselves. Hence, there are two questions that should be asked:

  1. Would revealing the block cipher algorithm you use as a building block in your schemes, potentially compromise your own security?
  2. Would revealing the block cipher algorithm you use as a building block in your schemes, potentially decrease your chances of compromising the security of the opposition?

The answer to the first question is no, for the reason SteveS wrote in his answer above. The second question is more interesting, if you are in to conspiracy theories. However, having seen a fair share of schemes implemented in real life application, I would not personally consider this aspect to be a concern. There are more ways AES has been used incorrectly that resulted in practically no security at all, than ways it has been used in a properly designed scheme that resulted in 256 bit security even after all design details, implementation details, deployment details and key management details had been take into account.

share|improve this answer

What sets apart government AES and a python script a highschooler can write is the implementation.

Even though AES is a completely open algorithm, the implementations used by the government are unclassified/controlled cryptographic items when not keyed - meaning even though the algorithm itself is not restricted in any way, the products that meet specific government standards are not publicly available and have to be constantly be accounted for by everyone who is authorized to use them.

Additionally, keys are updated very often and are generated at Ft. Meade (NSA Headquarters) so you can assume they do something special to make them more secure than the average computer can generate.

There are also Type 1 Suite A algorithms that are classified but you can still find some information reading by Raytheon, Harris, and General Dynamics whitepapers and yes, even Wikipedia. Like how Enhanced-Firefly is the current key agreement protocol and BATON is symmetric encryption with a 320bit key. There are some other ones like WALBURN, GOODSPEED, MEDLEY but as you'd expect, not much info is out there about them.

An interesting fact though is that AES-256 is a Type 1 AND Type 3 algorithm all at once. Again, the only thing that sets them apart is the implementation.

The general rule about how an open algorithm is more secure doesn't really apply to the NSA though because they employ more mathematics than any other single entity in the world and still work with the defense industry. One would think they don't release their work not because it would compromise any of their information but it sure would make their job more difficult if everyone in the world used their same security.

An example of a Type 1 implementation is the KIV-7M High Assurance Internet Protocol Encryptor.

share|improve this answer
Welcome to cryptography Stack Exchange. I added some paragraph breaks to your answer to make it easier readable – feel free to edit again if this somehow destroyed the meaning. Do you have some ideas how a different implementation of the same algorithm, using the same key, could produce a more secure ciphertext? Or do you suppose there are more and less secure keys for AES? – Paŭlo Ebermann May 15 '13 at 18:03
Hey Paulo, how come you never welcomed me to CST when I first signed on? I feel left out :-( – William Hird May 17 '13 at 6:53
@WilliamHird Sorry, I must have missed you. I normally only add a "Welcome" when I have something else to say, too, and maybe your start was perfect? Or back then I was not in the mood of welcoming people, since everyone was new (me included)? I don't know, it was almost two years ago. (I see I edited your first question, I should had added a comment, too. But I wasn't even a moderator then.) – Paŭlo Ebermann May 17 '13 at 22:46
Well there are different modes of AES as I'm sure you know, like GCM, which are better than others. Also when working with encryption systems and not just algorithms, you have to worry about buffer overflows caused by viruses to steal encryption keys and even accidental RF emission of plaintext. This actually happened with a Soviet encryption machine - if you listened into the background, you could actually hear the plaintext because the wires weren't properly insulated. – Андрей May 20 '13 at 2:31
Although I'm not a mathematician, I think it's fair to say not all keys are created equally. That being said, I'm sure they do something to discern weak(er) keys from strong(er) keys. – Андрей May 20 '13 at 2:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.