# Why is Fernet only AES-128-CBC?

I have a communication system that's currently encrypted using AES-256-CBC. Someone on Information Security StackExchange asked whether I'm using HMAC, so I'm looking into Fernet.

Fernet seems to use AES-128-CBC (link). This seems to me to be a) less secure than what I'm using and b) not sufficient to meet the requirements of some sensitive companies/entities that require AES-192 or AES-256.

Is this a problem? How should I decide whether to stick with my current approach or HMAC w/AES-128-CBC through Fernet?

• In general the key size is not a problem in the majority of protocols - unless the key size is grossly abused such as RSA-512. It's insecure schemes that are a major issue and other general security mistakes. I've seen countless schemes - especially on StackOverflow - that use AES-256 and are just completely wrong. Using your own approach with AES-256 will almost certainly be less secure. – Maarten Bodewes Jan 20 '17 at 10:04

This seems to me to be less secure...

Do you have a plausible adversary that can break AES-128? AES-128 is believed (to the best of knowledge) to require $O(2^{128})$ operations (unless someone has a Quantum Computer, in which can it takes $O(2^{64})$ Quantum operations, which might not be any more practical). For a reference, if an attacker has designed a chip with 1 million cores, and each core can test 1 billion keys per second, and he has 1 billion such chips, it'll still expected to take 4 million years before he happens to stumble across the correct key. Do you have an adversary who can devote considerably more resources to this task than my rather extreme example?

And, if AES-128 is secure from any plausible adversary you can have, how can you say it is 'less secure'?

In addition, if you're not using some sort of MAC, that means that you are open to adversaries who can modify your data; attackers can cause all sorts of mischief (including deducing the decryption in some cases) by doing that. That is a practical concern; IMHO, it far outweighs any concern about Space Aliens who could break AES-128.

Now, I have not reviewed Fernet; it could be that they got some details wrong (such as not selecting IVs correctly). However, we know there are issues if you don't do integrity checking on your ciphertext.

• I've reviewed Fernet in my spare time and made some comments on it. I couldn't find any major issues, but that doesn't mean that there aren't any. Note that I only reviewed the protocol, rather than the implementations. – Maarten Bodewes Jan 20 '17 at 10:02
• The US Government requires 192 or 256 for Top Secret level communications. They seem to think there is an advantage over 128 at that level. Are they wrong? – sscirrus Jan 20 '17 at 17:18
• @sscirrus 1) They're worried about nation states attacking, and potentially holding on to ciphertext for a couple of decades and decrypting it then. 2) That's top secret communications. They're okay with how far into the future it'll be before foreign powers can decrypt the secret and below stuff, which can still be very sensitive. – Rob Grant Apr 10 '18 at 17:25
• @RobertGrant This is pretty much my point. Of course, we're talking about highly rarefied situations - if I have a client who wants AES-256 with HMAC, why wouldn't Fernet provide it? – sscirrus Apr 10 '18 at 20:35
• @poncho Some government agencies and others can require AES-256 encryption. I don't see what the drawback is of offering it. In my case, traffic is low so the performance overhead of 256- vs. 128 isn't a factor. Also, the fact that it cannot be broken 'now' doesn't mean that 128 isn't less secure than 256 as speeds keep improving, especially if there is a step change in processors/logic. – sscirrus Apr 10 '18 at 20:38