1
$\begingroup$

So this one is a tinfoil-hat question. It is 99 % theoretical.

So we assume that I am someone who stores highly confidential information. Maybe super secret stolen goverment stuff. And I get caught by the authorities. The information is store in an AES256-XTS: Sha512 volume. The attacker has unlimited money and power. Maybe a data-center. So how long would it take to crack this and what would he attacks? The hash or the block cipher ?

PS: I know that AES was not chosen as standard because it is so secure, but because it has the best performance / hardware implementation / security balance. So maybe there are some AES backdoors in the implementation of some encryption-tools. So would it be better to use another algorithm in the case of highly sensitive data?

| improve this question | |
$\endgroup$
  • $\begingroup$ "Maybe a datacenter" - Those things don't have as much computing power as you might think, even large ones, for an attacker with unlimited money and power. A datacenter contains a bunch of consumer or enterprise-grade hardware. Unlimited money means literally hundreds or thousands of acres of exceedingly-fast ASICs. $\endgroup$ – forest Jan 12 '19 at 9:59
5
$\begingroup$

In practice, because they will target the easiest/weakest/least expensive link in the chain, they would attack you.

It is infinitely easier to threaten to crack someone's kneecaps to obtain their password then to crack an AES key.

Supposing they wanted to attack the cryptography specifically, for practice or fun, they would probably extract the key via a timing attack. This is not technically an attack on AES, it technically is an attack against a simple/common/fast implementation of AES. This is one of the few arguments I can think of for using an algorithm other then AES. Either that, or ensure that you utilize a constant time implementation of AES.

If your data is that confidential, then it is probably wise to utilize an algorithm that is not as vulnerable to leakage of information via side channels. Additionally, it's probably not safe to trust just software anymore: You would want a hardware security module.

Then, you need to become concerned with attacks against the hardware. You might opt for an algorithm that has been design with advanced counter-measures in mind, such as one based on the Keccak permutation.

| improve this answer | |
$\endgroup$
  • $\begingroup$ would a good cascade of eg : Serpent(Twofish(AES))) be a good choice in this scenario ? $\endgroup$ – Richard R. Matthews Mar 16 '17 at 23:04
  • 2
    $\begingroup$ and would you mind explaining how a side channel attack on aes xts would be carried out in a real life situation ? $\endgroup$ – Richard R. Matthews Mar 16 '17 at 23:22
  • 1
    $\begingroup$ @RichardR.Matthews For your first question: It does not protect your knee caps any better then just AES; Assuming you meant in regards to timing attacks, you might consider using an alternative algorithm on the actual plaintext. Your second question probably should be a separate question on the site, if it is not one already. $\endgroup$ – Ella Rose Mar 16 '17 at 23:51
  • 1
    $\begingroup$ add camellia in your first comment too :) or simon and spek algo $\endgroup$ – abraza Mar 17 '17 at 12:32
  • $\begingroup$ Kneecaps can be protected (or at least made less attractive as a cryptanalysis vector) by using standard OPSEC practices that ensure you are an incomplete source of information, for example by sharing parts of the key among multiple parties using a secret sharing algorithm. And side-channel attacks naturally do not apply to data-at-rest security. $\endgroup$ – forest Jan 12 '19 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.