6
$\begingroup$

We know that Grover's algorithm can speed up cracking symmetric keys. Basically the keyspace is halved. This means we have to use at least a 256-bit key (to get 128-bit security).

I heard somewhere it also has an effect on the block size (so we should use 256-bit blocks instead of 128)!

Is that true?

Improve this question
$\endgroup$
5
  • 3
    $\begingroup$ 1) I don't see that paper mentioning Rijndael with 256 bit blocks at all. It talks about AES with 128 bit blocks. AES-256 has a 256 bit key and 128 bit blocks. 2) Summarizing the paper as "AES-256 is not secure" is highly misleading. Related key attacks are irrelevant for pretty much every protocol that uses AES. 3) "Grover [...] cracking symmetric keys 2x faster" That's wrong too. A 2x speedup would be completely harmless. Grover halves the effective key-length, which is an exponential speedup. $\endgroup$
    – CodesInChaos
    Jan 4, 2013 at 9:29
  • $\begingroup$ @CodesInChaos so AES 264 don't have that problem ? (the main question is about protocol now not key size) $\endgroup$
    – mary
    Jan 4, 2013 at 13:57
  • 1
    $\begingroup$ What do you mean by "protocol size"? $\endgroup$
    – CodesInChaos
    Jan 4, 2013 at 18:34
  • 3
    $\begingroup$ Mary. I edited the title to use "block size" instead of "protocol size". Please check that this is actually what you mean, otherwise please edit your question again to clarify it. $\endgroup$
    – Paŭlo Ebermann
    Jan 4, 2013 at 19:15
  • $\begingroup$ @mary I think it is time you should accept a few answers, read the FAQ if you don't know how or when. $\endgroup$
    – Maarten Bodewes ♦
    Jan 5, 2013 at 18:15

1 Answer 1

Reset to default
5
$\begingroup$

It depends on the application. If you are using the block cipher as a hash function or for a MAC (say in CBC-MAC fashion), then it very well could create problems. Preimage attacks would be much easier than they should.

For normal encryption, however, there wouldn't be a problem since the key is not known to the attacker. As evidence of this, consider Triple DES which has a 64 bit block size yet is still sufficiently secure for use today (though I wouldn't recommend it in newer designs).

Improve this answer
$\endgroup$
1
  • 3
    $\begingroup$ I believe 3DES (or any cipher with a 64-bit block size) in CTR, CFB or OFB mode can be distinguished from a random stream after a few dozen gigabytes of output. Not a problem for most applications, though. $\endgroup$
    – Thomas
    Jan 5, 2013 at 1:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.