Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways:

The first would be for example using plain AES-256 encryption in CTR mode with a random key stored on paper.

The second, more suitable solution for backups, is using the Offline Private Key Protocol, e.g. generate a 4096 bit RSA key pair and encrypt with random AES-256 keys that get stored with the archives (key-wrapping) while the private part is again stored on paper. Kind of like Safeberg does.

My question is which of the two methods would be least susceptible to currently envisioned attacks in the next 30 years, coming from adversaries with resources such as your average government (i.e. not the NSA). What about quantum computing? Additionally I would like to know if there are any other, better alternatives or any improvements that I could make to both ideas without changing their practicality.

Thank you!

  • 2
    $\begingroup$ There is no asymmetric encryption/keyexchange that I'd trust for 30 years. $\endgroup$ Commented Apr 27, 2013 at 11:33

2 Answers 2


The AES solution will fail if either:

  • the secret key is leaked, or

  • AES-256 is broken.

The RSA+AES solution will fail if either of the above happens, or if:

  • RSA-4096 is broken.

Thus, even without considering the relative likelihoods of these events occurring within the next 30 years, it is clear that the AES-only solution cannot be any less secure than the RSA+AES one.

Of course, the RSA+AES solution has the practical advantage that the system performing the bulk of the work (AES encryption of data) need not know your secret RSA key (although they will, of course, still need access to the AES key used to actually encrypt the data, not to mention the data itself). You will need to decide for yourself whether this extra feature outweighs the risk of complicating your system by introducing an extra point of potential failure.

  • $\begingroup$ I am wondering then if, given a zero probability that the public RSA key is leaked from the bulk encryption system, how much less secure the RSA+AES solution will be. I've asked this as a separate question. $\endgroup$
    – kouk
    Commented Apr 29, 2013 at 7:16
  • $\begingroup$ The advantage of a wrapper key per file is, that you can disclose or lose only that key. $\endgroup$
    – eckes
    Commented Nov 27, 2015 at 0:06

AES-256 is probably fine, but RSA-4096 is not.


AES is an example of a symmetric block-cipher. Among block-ciphers AES seems to be the most trusted.

One major threat to AES and other block-ciphers is the grover algorithm. By brute force, the time taken to crack the cipher is asymptotically proportional to the number of possible keys. In the case of AES-256, the time is proportional to 2^256. Nothing will happen 2^256 times in the next 30 years. However, the time it takes to find the key with Grover's algorithm is asymptotically proportional to the square root of the number of possible keys. For AES-256 that's 2^128.

Grover's algorithm has a major disadvantage in that it can only be performed on a quantum computer. It's implausible in 40 years quantum computers will be powerful enough that non-NSA adversaries can crack AES-256. However it's hard to tell what the future will bring. Consider other block-ciphers with greater key sizes, like threefish.

The other possibility for it to be cracked is that AES is broken in the next 30 years. By "broken" I mean someone finds a cryptanalysis method that no one thought of and works extremely well on AES. This is a very real threat, however AES is probably the safest from it than anything else.


I previously mentioned Grover's algorithm is only possible on quantum computers. Shor's algorithm is also for quantum computers. Long story short it is reasonable that RSA-4096 will be crackable within 40 years.

There are alternative asymmetric encryption methods that are quantum resistant. They are all pretty new so I would probably avoid asymmetric encryption altogether. A convenient list of algorithms you can use is the list of the NIST competition candidates.

  • $\begingroup$ I have the very question I tried to answer except I am looking for something to be safe for the next hundred years. So AES-256 is probably inadequate. $\endgroup$
    – Nic
    Commented May 20, 2020 at 2:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.