I've looked at NIST documents and done many Google searches, but I can't find an answer to this seemingly simple question.

I am storing data on harddrives, encrypted with AES-XTS 256 bit. Some of this data has a long lifetime, i.e. will still be valuable to an attacker and not good to lose into the future.

My scenario is that a harddrive could be lost today, and while the AES encryption is unbreakable today, how about in 20 years? 30 years? An attacker could keep it or find it in the future and use an not-yet-known attack to break it. Of course this is guesswork, my question is if there is an "official guess" from the NIST or someone else that I can quote and that says "we consider AES-256 secure until at least 2030" or some such.


1 Answer 1


NIST doesn't make recommendations based on just the cipher alone. NIST SP 800-57 Part 1 includes some discussion of this. Section 5.2 (on page 44) explains rationale for having "cryptoperiods". They list many factors affecting long term security, with an emphasis on key exposure. It's not as simple as guessing the security of AES because AES is just one piece of a larger implementation, with many avenues for key exposure.

If you're looking for a number for how long to keep using a symmetric data encryption key, they say the following on page 50:

A maximum recipient usage period of 3 years beyond the end of the originator usage period is recommended

This is not because they think AES is going to be practically broken in 3 years; it's because it's difficult to keep entire systems secure long term, and rotating the key periodically is a good idea. For your use case, I think the suggestion to change the key every 3 years is reasonable.

Now, it's very hard to give a direct answer to your question about AES itself. It's a very heavily studied cipher and currently the best known attacks are completely impractical. That's the best we can say about any cipher. Nobody knows what kind of attacks will be available 30 years from now. Some may argue for a 192 or 256 bit key length due to the threat posed by quantum computers implementing Grover's algorithm, but this is not currently feasible with any known QC and speculating on when it will become so is probably impossible.

  • $\begingroup$ I realize that in an attack scenario, the key getting compromised is more likely than AES being broken. I am, however, worried about lost, discarded and forgotten drives, where I can assume that the key has long been lost or deleted or cannot be connected to the drive anymore (e.g. the "bad guy finds one of our old harddrives in a landfill" scenario). $\endgroup$
    – Tom
    Nov 30, 2016 at 16:15
  • $\begingroup$ A cryptanalytic attack on AES would have to require less work than guessing the password to be worth it, and that's extremely unlikely. If you were using key files with random data, it may be easier than guessing a random 256 bit key, but then you have to worry about how you dispose of that key file and the media it's stored on. I'd just pick a good 7 word or longer Diceware passhrase, strengthen the KDF if possible, and not worry about it. $\endgroup$
    – user40185
    Nov 30, 2016 at 16:28
  • $\begingroup$ Good answer. With that timeframe, a brute-force attack might actually be more feasable than a break of AES. $\endgroup$
    – Tom
    Nov 30, 2016 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.