I have some very sensitive family files that I want to store in the cloud on multiple providers for maximal reliability and redundancy. It's essentially a large archive of all our family photos, documents, and confidential photos. I'll be needing them in about ~20 years, but I won't access them or update them during this interval. These files must not be accessed by anyone but myself.

I am skeptical about AES being able to last for that long, because there could be advances in cryptanalysis. Instead, I'm considering ChaCha20, because it's a modern cipher and was sought for by security engineers at Google.

Supposing that I encrypt all files offline, use a secure key (along with Argon2), and ensure integrity (Poly1305), will my data theoretically be able to last for that long (the best attacks on ChaCha20 only break 7 rounds)? If not, is there a possible cipher that could? There will only be one copy, preventing chosen-plaintext attacks.

  • 1
    $\begingroup$ This question cannot be answerable. We are not fortune tellers. AES withstand 20 years of extensive attacks and AES-256 will probably go for another 20 years. $\endgroup$
    – kelalaka
    Feb 21 '21 at 22:18
  • 1
    $\begingroup$ Makes sense. I suppose it is hard to answer a question like this without seeing the future. Should I delete it? $\endgroup$
    – Evan Su
    Feb 21 '21 at 22:22
  • 5
    $\begingroup$ This is one of the few instances where double encryption could be your friend. Just encrypt twice, once with ChaCha20 and once with AES-CTR. Note though that chances are that the symmetric ciphers are the problem is minute - bad media, bad passwords (if those are used), bad deletion of the files etc. are much more likely to bug you. $\endgroup$
    – Maarten Bodewes
    Feb 21 '21 at 22:35

There's simply no way to know. I find it very unlikely that AES will be vulnerable to a ciphertext-only attack in the next 20 years (remember, it has been around for over 20 years already and attacks haven't gotten very far). There's no reason to believe the same won't be true for ChaCha20. If you use a good cipher with 256-bit keys (to avoid potential speedups from quantum computers running Grover's algorithm which halves the effective key size of a symmetric cipher), you should be fine.

If you really, really want, you could use something like VeraCrypt which provides you with the option to use three ciphers in a row: AES, Serpent, and Twofish, all of which are extremely secure.

We can say with some level of confidence that it will remain secure for your purposes.

  • 2
    $\begingroup$ @HACKERALERT It can be proven that cascading ciphers can't be less secure than any of the individual ciphers. And I'd just use AES, Twofish, Serpent. I don't think you need to include ChaCha20 since then you'd have to modify VeraCrypt's code. $\endgroup$
    – forest
    Feb 21 '21 at 22:45
  • 1
    $\begingroup$ @PaulUszak Quantum computing breaks asymmetric cryptography in the BQP complexity class. Grover's algorithm on the other hand is a "database search" algorithm but it can't be parallelized well and only halves effective keyspace. QCs can't break AES like it can RSA and if it did, you need only to double the key size (whereas you'd have to bring the RSA key size from 2 KiB to closer to 2 TiB). $\endgroup$
    – forest
    Feb 21 '21 at 23:56
  • 3
    $\begingroup$ @HACKERALERT CD readers will certainly exist in 20 years (I mean, we can read pretty much any retro medium right now, even 40 year old ones), but whether or not the CD will have degraded in that time is another matter... They aren't as good as archiving as, say, refrigerated tapes. $\endgroup$
    – forest
    Feb 22 '21 at 1:00
  • 2
    $\begingroup$ "It can be proven that cascading ciphers can't be less secure than any of the individual ciphers." Only for ciphers which commute. XTS mode means that they do, so this is true for Veracrypt cascades, but not true in general. In general, cascades are only as strong as the innermost cipher. isiweb.ee.ethz.ch/archive/massey_pub/pdf/BI434.pdf $\endgroup$ Feb 22 '21 at 1:23
  • 1
    $\begingroup$ @SAIPeregrinus I believe it's enough to have ciphers where the length of the ciphertext only depends on the length of the plaintext and not its content to guarantee that a cascade is secure if at least one of the ciphers is secure. $\endgroup$ Feb 22 '21 at 16:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.