Skip to main content
Cryptography

Return to Answer

added 447 characters in body
Source Link
bk2204
bk2204
  • 3.5k
  • 6
  • 12

We currently believe that 128-bit security is sufficient for all current and future computing needs. For example, using the theoretical minimum amount of energy, storing $ 2^{128} $ bits would require more energy than boiling the world's oceans. As such, providing 128 bits of security with a 256-bit key after quantum computing should be secure since an attacker is not typically expected to practically harness the energy resources of multiple celestial bodies.

It is the case that in certain situation, such as with block ciphers in CTR mode, you can be vulnerable to multitarget attacks where the attacker can attack many keys at once with the same input block at the same time. This is one case in which 128-bit security isn't ideal. However, this is easily avoided in many cases by deriving the IV and the key using a KDF, which many protocols do already, so it's not a serious risk in most cases.

It may in the future be such that we would like to hedge against future advances and build symmetric algorithms with 512-bit keys, but at this point, it doesn't seem practically necessary.

We currently believe that 128-bit security is sufficient for all current and future computing needs. For example, using the theoretical minimum amount of energy, storing $ 2^{128} $ bits would require more energy than boiling the world's oceans. As such, providing 128 bits of security with a 256-bit key after quantum computing should be secure since an attacker is not typically expected to practically harness the energy resources of multiple celestial bodies.

It may in the future be such that we would like to hedge against future advances and build symmetric algorithms with 512-bit keys, but at this point, it doesn't seem practically necessary.

We currently believe that 128-bit security is sufficient for all current and future computing needs. For example, using the theoretical minimum amount of energy, storing $ 2^{128} $ bits would require more energy than boiling the world's oceans. As such, providing 128 bits of security with a 256-bit key after quantum computing should be secure since an attacker is not typically expected to practically harness the energy resources of multiple celestial bodies.

It is the case that in certain situation, such as with block ciphers in CTR mode, you can be vulnerable to multitarget attacks where the attacker can attack many keys at once with the same input block at the same time. This is one case in which 128-bit security isn't ideal. However, this is easily avoided in many cases by deriving the IV and the key using a KDF, which many protocols do already, so it's not a serious risk in most cases.

It may in the future be such that we would like to hedge against future advances and build symmetric algorithms with 512-bit keys, but at this point, it doesn't seem practically necessary.

Source Link
bk2204
bk2204
  • 3.5k
  • 6
  • 12

We currently believe that 128-bit security is sufficient for all current and future computing needs. For example, using the theoretical minimum amount of energy, storing $ 2^{128} $ bits would require more energy than boiling the world's oceans. As such, providing 128 bits of security with a 256-bit key after quantum computing should be secure since an attacker is not typically expected to practically harness the energy resources of multiple celestial bodies.

It may in the future be such that we would like to hedge against future advances and build symmetric algorithms with 512-bit keys, but at this point, it doesn't seem practically necessary.