After Edward Snowden's release of top secret information we have seen clues that the NIST certified crypto-algorithms like AES might be compromised.

Although not as fast as AES, we prefer Twofish because we are suspicious of anything NIST certified (we explain why here.) We’ll also go with the Whirlpool hash algorithm for the same reason (see the full documentation for more info on this subject)

From https://www.bestvpn.com/blog/18538/veracrypt-how-to-basics/

Also from another article on the same site: https://www.bestvpn.com/blog/4147/pptp-vs-l2tp-vs-openvpn-vs-sstp-vs-ikev2/. If you scroll down to the NIST section they discuss this built-in back doors in NIST certified crypto-algorithms with different sources of evidence.

So they recommend using Twofish, but compared to AES, Twofish algorithm strenght isn't as good as AES. Also AES is "pretty" post-quantum computer algorithm proof, but is Twofish too?

My question is: in for an example Veracrypt you can choose between different algorithms. Should you pick AES, Twofish, AES(Twofish) or Twofish(AES). Also if you should choose Twofish, is it post-quantum computer algorithm proof? Even a little?

  • $\begingroup$ To our best knowledge Twofish is as quantum secure as AES. Side-channel resistance may be a different matter though due to Twofish's secret s-boxes... $\endgroup$
    – SEJPM
    Commented Mar 31, 2017 at 13:53
  • $\begingroup$ Good, then you can use if for some time. $\endgroup$
    – NetCoder
    Commented Mar 31, 2017 at 13:54
  • 1
    $\begingroup$ I don't see any valid reason to distrust AES... not even when wearing a tin-foil-hat. $\endgroup$
    – e-sushi
    Commented Mar 31, 2017 at 14:15
  • $\begingroup$ When I look at their "reasons", the most I see is reasoning to distrust DUAL_EC_DRBG but we distrusted it pretty much since it was standardized anyways (let alone the fact that it was slow and biased). $\endgroup$
    – SEJPM
    Commented Mar 31, 2017 at 14:20

1 Answer 1


Should you pick AES, Twofish, AES(Twofish) or Twofish(AES)?

You should pick AES.

Also if you should choose Twofish, is it post-quantum computer algorithm proof?

There's no current publicly known attack that breaks Twofish any faster than Grover's algorithm (using quantum computers), so it is as secure as AES in that regard. However it is likely much more difficult to securely implement Twofish than it is to securely implement AES (due to the large secret S-Boxes) and the last meaningful cryptanalysis result against Twofish is more than one and a half decades old because research focused on AES.

  • $\begingroup$ Thank you for your information but I will wait 1 day for any other perspectives. $\endgroup$
    – NetCoder
    Commented Mar 31, 2017 at 15:20
  • $\begingroup$ @NetCoder That's fine, I usually do the same :) $\endgroup$
    – SEJPM
    Commented Mar 31, 2017 at 15:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.