implementing long term archive encryption

Question

Let's say I want to create private archives for the long term (e.g. more than 30 ). The archives' sizes could be anywhere from 1 GB to 30 GB. As far as I understand I could go down two ways:

The first would be for example using plain AES-256 encryption in CTR mode with a random key stored on paper.

The second, more suitable solution for backups, is using the Offline Private Key Protocol, e.g. generate a 4096 bit RSA key pair and encrypt with random AES-256 keys that get stored with the archives (key-wrapping) while the private part is again stored on paper. Kind of like Safeberg does.

My question is which of the two methods would be least susceptible to currently envisioned attacks in the next 30 years, coming from adversaries with resources such as your average government (i.e. not the NSA). What about quantum computing? Additionally I would like to know if there are any other, better alternatives or any improvements that I could make to both ideas without changing their practicality.

Thank you!

Answer 1

The AES solution will fail if either:

• the secret key is leaked, or

• AES-256 is broken.

The RSA+AES solution will fail if either of the above happens, or if:

• RSA-4096 is broken.

Thus, even without considering the relative likelihoods of these events occurring within the next 30 years, it is clear that the AES-only solution cannot be any less secure than the RSA+AES one.

Of course, the RSA+AES solution has the practical advantage that the system performing the bulk of the work (AES encryption of data) need not know your secret RSA key (although they will, of course, still need access to the AES key used to actually encrypt the data, not to mention the data itself). You will need to decide for yourself whether this extra feature outweighs the risk of complicating your system by introducing an extra point of potential failure.

Answer 2

AES-256 is probably fine, but RSA-4096 is not.

AES

AES is an example of a symmetric block-cipher. Among block-ciphers AES seems to be the most trusted.

One major threat to AES and other block-ciphers is the grover algorithm. By brute force, the time taken to crack the cipher is asymptotically proportional to the number of possible keys. In the case of AES-256, the time is proportional to 2^256. Nothing will happen 2^256 times in the next 30 years. However, the time it takes to find the key with Grover's algorithm is asymptotically proportional to the square root of the number of possible keys. For AES-256 that's 2^128.

Grover's algorithm has a major disadvantage in that it can only be performed on a quantum computer. It's implausible in 40 years quantum computers will be powerful enough that non-NSA adversaries can crack AES-256. However it's hard to tell what the future will bring. Consider other block-ciphers with greater key sizes, like threefish.

The other possibility for it to be cracked is that AES is broken in the next 30 years. By "broken" I mean someone finds a cryptanalysis method that no one thought of and works extremely well on AES. This is a very real threat, however AES is probably the safest from it than anything else.

RSA

I previously mentioned Grover's algorithm is only possible on quantum computers. Shor's algorithm is also for quantum computers. Long story short it is reasonable that RSA-4096 will be crackable within 40 years.

There are alternative asymmetric encryption methods that are quantum resistant. They are all pretty new so I would probably avoid asymmetric encryption altogether. A convenient list of algorithms you can use is the list of the NIST competition candidates.