First of all, I'm relatively new to encryption so please bear with me. I'm looking for a way to encrypt large amounts of data only on my device, no need to transfer my encrypted files/data (10-20GB or less), I don't really care about speed as long as the encryption is really strong. I have tried encryption with AES-GCM and using RSA for encrypting the AES Keys, but AES doesn't really give me that safety feeling like it's only 256bits maximum.
$\begingroup$
$\endgroup$
10
-
4$\begingroup$ There is no best option only advantages and disadvantages, after that the preferable choice. AES-256 is classical and quantum secure, RSA is very slow and not for encryption either! AES has CPU instruction that makes it very fast. You should consider the Veracrypt Volume that handles most of the problems that you did not consider, like how the encryption keys are handled, etc. $\endgroup$– kelalakaJan 3, 2021 at 12:10
-
$\begingroup$ @kelalaka I meant that many people suggested me to use AES-GCM and encrypt the AES key with RSA $\endgroup$– Ilkay SolotovJan 3, 2021 at 12:12
-
5$\begingroup$ You may want to re-evaluate your feeling of safety with 256-bit keys given that it would take all of the the sun's energy to even count to $2^{192}$ within 32 years. And that's one $2^{64}$th of the required energy to count to $2^{256}$. $\endgroup$– SEJPMJan 3, 2021 at 12:36
-
3$\begingroup$ If a god needs to decrypt your files then it is a false god. Be realistic about your risks! $\endgroup$– kelalakaJan 3, 2021 at 12:56
-
4$\begingroup$ You have a much higher risk of someone guessing the password used to protect the RSA key that's protecting the AES key than breaking the AES key. $\endgroup$– SwashbucklerJan 3, 2021 at 14:23
|
Show 5 more comments
3 Answers
$\begingroup$
$\endgroup$
0
Based on your comments I have a feeling that may be you don't really understand what a huge number of combinations a 256-bit key means. At the first glance 256 bit is "just" 16 bytes. But look at it closer. With 256 bits we can encode $2^{256} = 10^{77}$ numbers. It is 100 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 numbers.
Still too theoretical? You may get better feeling if you run a simple Python script:
i = 0
while i < 100000000000000000000000000000000000000000000000000000000000000000000000000000: # 2^256 ~= 10^77
if (i % 100000000 == 0):
print i
i = i + 1
Every second, on weaker CPUs may be every 10 seconds, you will see a 9-digit number. In 1 day you will see the numbers are 10-digits. In 100 days you will see 12-digit numbers. In 3 years you will see 13-digit numbers. If you pay for 1 000 computers for 30 years, then you will get 16-digit numbers. Still extremely far from 77-digit numbers.
This script is very simple and fast. But brute-forcing of AES will be much slower. For every key candidate one would need to decrypt some considerable peace of data, then analyze if decrypted data mean anything like document, image, video.
Be realistic. Estimate how much money would an attacker obtain if your files are brute-forced and if they can sell your files to somebody. Will they get \$1 000, \$1 000 000? Nobody will brute-force your AES password (except checking against dictionary with typical weak passwords and their variations, which is very quick). If your secrets are worth \$1 000 000, then it may be much cheaper to pay hackers $500 000 to break into your system, read your passwords or install key loggers; or install spy cameras in your home, your car etc. and thus get your passwords; or steal your key if you have hardware token.
TLDR: AES with 256-bit key is more than sufficient.
answered Jan 3, 2021 at 18:24
$\begingroup$
$\endgroup$
I don't think you need RSA either. Where will you store the private key and how will you protect it from being stolen anyway? Use a good and hard to guess password, and a long enough salt and use a good KDF to derive an AES key to encrypt your data, I think it will work better? And 256 bits is huge, it will take many times longer than the age of current universe, using every single computer in this world to successfully crack 256 bit AES, as others have told already.
$\begingroup$
$\endgroup$
1
As @mentallurg answered: use AES-256. Today, any cipher at or above 128-bit security level is very strong and as John Kelsey says: "Thare is no meaningful difference between 192-bit and 256-bit keys in terms of practical bruteforce attacks; impossible is impossible."
But, just to bear with you: you can use Threefish-1024. Threefish is a fast and secure tweakable block cipher with three different key/block sizes: 256, 512 and 1024 bits that is suitable for encrypting large data files, when is using with a block cipher mode like CMC or EME.
-
1$\begingroup$ I didn't say RSA is needed :) I don's see any reason for encrypting the key with another key. $\endgroup$ Jan 4, 2021 at 2:51