# Is Threefish the only cipher with 1024 bits of security?

Threefish has up to a massive 1024 bits of security. Is it the only cipher with such overkill security?

• Assuming that by "bits of security" you are solely referring to the key size, RC4 can take keys up to 2048 bits. – mikeazo Apr 14 '16 at 14:48
• And the cipher modes of Skein and Keccak allow arbitrary length keys, IIRC. – otus Apr 14 '16 at 15:37
• VME (Virtual Matrix Encryption) [meganet.com] provides patented (US6219421) 1 million bit encryption. However, this is just the key size, and it most likely does not mean that the algorithm is $2^{1048320}$ times harder to break than AES. – user4982 Apr 14 '16 at 16:35
• RC5 and RC6 can accept keys up to 2040 bits. But they probably don't provide 2040 bit security. – LightBit Apr 15 '16 at 16:47
• @user4982 Proving once again that patented algorithms are, statically speaking, snake oil. – Thomas May 24 '16 at 8:16

If we are talking about symmetric encryption, the PAGES block cipher based on Speck support key size 1024 bits and PAGES+/PAGES— variants support key sizes up to 2048 bits. However, I have not seen any independent cryptanalysis of these, so I can't recommend them. If we talk about the ciphers which have some cryptanalysis available, the Kalyna block cipher supports up to 512-bit keys.

ISAAC can have up to $2^{2^{13}}$ bit keys and has no known attacks better than at least $4.67⋅10^{1240} > 2^{4121}$ complexitiy (assuming that the initial state is chosen uniformly at random). It is a stream cipher, but this can still be used for AEAD.

While old and with only minimal cryptanalysis, the best known attack is still much harder than the brute-force attack against Threefish-1024 (note that this is purely theoretical – not even a quantum computer with the entire universe as fuel could conduct either attack with a reasonable success probability).

• You mean a keyspace of $2^{2^{13}}$? That's not the key length. – forest Sep 8 '19 at 7:25

Nope. Besides old RC4, you can use RSA directly as your cipher at arbitrarily large bitness. We normally don't because its too slow.

• I think the bitness is not directly comparable between symmetric and asymmetric ciphers. – user9070 Apr 14 '16 at 17:06
• For any symmetric bit size, there is an asymmetric bit size for any non-broken asymmetric algorithm for which there is as least as much protection. (for EC you would have to use a larger curve base but ...) – Joshua Apr 14 '16 at 17:12
• Heh, I would not want to use an RSA key that provides 1024 bits of security. The size of the key would be gargantuan. (You know, I've always liked that word... 'gargantuan'... so rarely have an opportunity to use it in a sentence. :P ) Key size does not equal cryptographic strength. – Maarten Bodewes Apr 14 '16 at 17:57
• NIST key management guidelines suggest that 15360-bit RSA keys are equivalent in strength to 256-bit symmetric keys… if you’ld calculate the RSA keysize you would need to reach something comparable to 1024 bits of symmetric security you would understand how your answer just screams “supersize me”. (In the end, your suggestion would be as impractical as a One Time Pad. In fact, OTPs would most probably end up being much smaller and more practical than the mammoth RSA keys you suggested.) – e-sushi May 24 '16 at 2:01
• @e-sushi equivalent to 1024-bit symmetric key would be around 460800-bit RSA key (see FIPS 140-2 Implementation Guidance page 92 for conversion formula). – user4982 May 24 '16 at 17:29