3
$\begingroup$

I have some very sensitive family files that I want to store in the cloud on multiple providers for maximal reliability and redundancy. It's essentially a large archive of all our family photos, documents, and confidential photos. I'll be needing them in about ~20 years, but I won't access them or update them during this interval. These files must not be accessed by anyone but myself.

I am skeptical about AES being able to last for that long, because there could be advances in cryptanalysis. Instead, I'm considering ChaCha20, because it's a modern cipher and was sought for by security engineers at Google.

Supposing that I encrypt all files offline, use a secure key (along with Argon2), and ensure integrity (Poly1305), will my data theoretically be able to last for that long (the best attacks on ChaCha20 only break 7 rounds)? If not, is there a possible cipher that could? There will only be one copy, preventing chosen-plaintext attacks.

Improve this question
$\endgroup$
5
  • 1
    $\begingroup$ This question cannot be answerable. We are not fortune tellers. AES withstand 20 years of extensive attacks and AES-256 will probably go for another 20 years. $\endgroup$
    – kelalaka
    Commented Feb 21, 2021 at 22:18
  • 1
    $\begingroup$ Makes sense. I suppose it is hard to answer a question like this without seeing the future. Should I delete it? $\endgroup$
    – Evan Su
    Commented Feb 21, 2021 at 22:22
  • 5
    $\begingroup$ This is one of the few instances where double encryption could be your friend. Just encrypt twice, once with ChaCha20 and once with AES-CTR. Note though that chances are that the symmetric ciphers are the problem is minute - bad media, bad passwords (if those are used), bad deletion of the files etc. are much more likely to bug you. $\endgroup$
    – Maarten Bodewes ♦
    Commented Feb 21, 2021 at 22:35
  • $\begingroup$ I might be mistaken, but if the essence of this question is "what's the best encryption algorithm", then it's blatently off-topic per founding spirit of the SE networks. $\endgroup$
    – DannyNiu
    Commented Mar 9, 2022 at 12:12
  • $\begingroup$ A question about cryptography shouldn't exist in this cryptography s.e? $\endgroup$
    – Evan Su
    Commented Mar 9, 2022 at 12:27

2 Answers 2

Reset to default
11
$\begingroup$

There's simply no way to know. I find it very unlikely that AES will be vulnerable to a ciphertext-only attack in the next 20 years (remember, it has been around for over 20 years already and attacks haven't gotten very far). There's no reason to believe the same won't be true for ChaCha20. If you use a good cipher with 256-bit keys (to avoid potential speedups from quantum computers running Grover's algorithm which halves the effective key size of a symmetric cipher), you should be fine.

If you really, really want, you could use something like VeraCrypt which provides you with the option to use three ciphers in a row: AES, Serpent, and Twofish, all of which are extremely secure.

We can say with some level of confidence that it will remain secure for your purposes.

Improve this answer
$\endgroup$
12
  • 2
    $\begingroup$ @HACKERALERT It can be proven that cascading ciphers can't be less secure than any of the individual ciphers. And I'd just use AES, Twofish, Serpent. I don't think you need to include ChaCha20 since then you'd have to modify VeraCrypt's code. $\endgroup$
    – forest
    Commented Feb 21, 2021 at 22:45
  • 1
    $\begingroup$ @PaulUszak Quantum computing breaks asymmetric cryptography in the BQP complexity class. Grover's algorithm on the other hand is a "database search" algorithm but it can't be parallelized well and only halves effective keyspace. QCs can't break AES like it can RSA and if it did, you need only to double the key size (whereas you'd have to bring the RSA key size from 2 KiB to closer to 2 TiB). $\endgroup$
    – forest
    Commented Feb 21, 2021 at 23:56
  • 3
    $\begingroup$ @HACKERALERT CD readers will certainly exist in 20 years (I mean, we can read pretty much any retro medium right now, even 40 year old ones), but whether or not the CD will have degraded in that time is another matter... They aren't as good as archiving as, say, refrigerated tapes. $\endgroup$
    – forest
    Commented Feb 22, 2021 at 1:00
  • 2
    $\begingroup$ "It can be proven that cascading ciphers can't be less secure than any of the individual ciphers." Only for ciphers which commute. XTS mode means that they do, so this is true for Veracrypt cascades, but not true in general. In general, cascades are only as strong as the innermost cipher. isiweb.ee.ethz.ch/archive/massey_pub/pdf/BI434.pdf $\endgroup$
    – SAI Peregrinus
    Commented Feb 22, 2021 at 1:23
  • 1
    $\begingroup$ @SAIPeregrinus I believe it's enough to have ciphers where the length of the ciphertext only depends on the length of the plaintext and not its content to guarantee that a cascade is secure if at least one of the ciphers is secure. $\endgroup$
    – CodesInChaos
    Commented Feb 22, 2021 at 16:17
1
$\begingroup$

I asked myself a similar question about a year ago.

Here's my similar use case, (I imagine it's a common scenario):
I own a decent amount of crypto currency, know how to do crypto taxes, etc. (For me it's a hedge against the possibility of hyper inflation + diversification of my index funds.) After doing tons of research I came to the conclusion that hardware cryptocurrency wallets are dumb, and I prefer something called a "paper wallet". The idea is you have a really long password that you could hypothetically write down on a piece of paper and it's a seed that can deterministically recreate the public private key pair associated with your crypto wallet AKA recreate your Crypto Currency Wallet from a deterministic seed. Alternatively you can store your "paper wallet" (it's just a long password) in a .txt and save it to the cloud to get redundancy.

The reason I'm sharing that background context is to point out that I too have "very sensitive family files" (if anyone get's access to my paper wallet / crypto wallets deterministic seed / really long password, they can steal all my crypto) and I too wanted:

  • Safe long term geo redundant storage for disaster recovery. (If my house burns down, my data should still be accessible.)
  • Bit rot protection (protection against quantum degradation)
  • Legit security that'd be safe for decades (including post quantum cryptography proof)
  • Good user experience (it should be easy enough for my entire family to use, not just me.)

Here's what I used to do and don't recommend:
(I'm sharing my real world experience about being a Veracrypt user for over 10 years and then permanently moving away from Veracrypt, mentioning it due to a comment above.) I used to use store my crypto paper wallets in a Veracrypt volume on dropbox, but over the course of 10++ years I discovered that dropbox and many others didn't correctly detect edits of files inside the Veracrypt volume (it used to in a really old version of dropbox, but then they changed some underlying algorithm and it stopped working.) I discovered I'd lose data when I'd upgrade computers as dropbox would have an old copy of the data, unless I diligently remembered to rename the Veracrypt volume after editing the contents inside to force a re-upload. (I tried dropbox and many other providers with similar results their scanning for edits algorithm just wouldn't consistently correctly detect changes.) (Also Veracrypt had a requirement for thick provisioning of volumes, and would sometimes need a complete reupload for a single small edit, so basically it's a terrible fit to try to store a Veracrypt volume (a file that you can mount as a virtual filesystem) on cloud volume storage.)

Here's my personal future proof solution:

  • I use cryptomator (FOSS, with an optional "supporter" license that you can buy.) In a nut shell it:

  • Is a cross platform app (Linux, Windows, Mac, etc.)

  • Has a great KISS UX

  • Follows Unix philosophy of do 1 thing and do it well / good separation of concerns: It pre-encrypts your data, then you can store it on an arbitrary untrusted backend that supports features like global redundancy and anti bit rot protection. (you let an arbitrary cloud file storage service like dropbox, google drive, one drive, box, sync.com, tresorit.com, or whatever you like, store your data. The great thing is it's a zero trust architecture, in theory you could even make your backend data publicly accessible on the internet and be fine.)

  • How does the separation of concerns work? It's similar to VeraCrypt in that it mounts a virtual file system, the main difference is its designed to work with cloud file storage backends. Instead of the encrypted virtual file system being represented by a single file. It uses FUSE / WebDAV file system virtualization to create a 1:1 mapping of encrypted files to cleartext files. In other words from say dropbox's perspective (The NSA, USA's Patriot Act "Big Brother" programs, dropbox staff, and hackers who have gotten unauthorized access to dropbox's files from historic data breaches who are all spying on your files you uploaded), they only see 1 encrypted file. But from the perspective of your local machine, where you typed your symmetric decryption key in and it was loaded into ram, and used to mount a virtual FUSED file system. You'd see 1 cleartext file that you can use and edit just like a normal file. When you edit your 1 cleartext file, the corresponding encrypted file stored in dropbox gets edited, so editing a cleartext file, edits it's corresponding encrypted twin file (this is critical as it means differential edits to encrypted files are correctly detected and sync'd to the cloud. + allows thin provisioning, and bandwidth saving.)

  • So yeah it does client side encryption / decryption of data in a seamless way, such that data is pre-encrypted before being sent to the cloud and only ever decrypted on your local machine, never decrypted on cloud servers.

  • Cryptomator uses NIST approved AES symmetric encryption. This next part is critically important for safe long term storage. You need to think up a password that you can memorize cold that's at least 43 characters in length. According to this SO Q&A. Me personally instead of memorizing gibberish I chose to memorize gibberish + an easy to remember phrase and since that's less random I chose to memorize a password over 70 characters in length. The point is that the length and complexity of my password ensure I have at least 256 bits of security. (Key Concept: It's the length of your password that gives 256++ bits of security not the underlying algorithm). Once quantum computers become mainstream, they'll be able to run an quantum cryptography algorithm that can completely compromise current asymmetric encryption public private key pairs, but the quantum cryptography algorithms can at best cut the strength of symmetric keys in half. So in a post quantum computer world the 256++ bits of security in my password are more like 128++bits of security. (The cool thing is 128 bits of security is permanently brute force proof, see linked SE Q&A for details)

    • TIP: If you can't remember a 43 character password, you could always use a secure password manager like bit-warden, enable MFA on the password manager, and store the the 43 character random gibberish in bit-warden, or first 38 characters of your symmetric key (AKA password) in bit-warden, then commit the last 5 character's to memory. Btw Bit-warden has a good feature where you can create organizations / family orgs and have shared passwords between family members. So you and your significant other can setup solid MFA protected access to bit warden, and set RBAC access to shared secrets. (It's worth noting that this person would need to be family as you couldn't revoke their access since it'd be a symmetric key, but there's cases where this could be desirable. Alternatively if you wanted to account for in the case of death you want a family member to be able to gain access to your data, you could always create a sealed will and have a written copy of the decryption key there.)

  • I like to use overkill level paranoia (mostly for fun / learning purposes), so I also do the following that I think could be optional for most people / defense in depth security.

    • My personal computer can be considered a secure endpoint device, since I don't use Windows. Instead I use Debian with Cinnamon Desktop Environment (The user interface is similar to Windows 7, and it's way more secure than Windows. Technically OpenSUSE's MicroOS + KDE would be even more secure, but Fold-at-home's SUSE packages are currently broken, so I went with Debian.)
    • AES has gone largely un-compromised for over 24 years now (published in 1998), but I like my tin foil hats. So I like to use trusted services to make sure I'm the only one who has access to my data. A nation state would need to get access to a copy of your encrypted data before they could even take a shot at trying to compromise it. I personally don't trust dropbox, Microsoft Drive, Google Drive, and many others. I trust sync.com, but they don't have a Linux client. So I started to use one of the most trust worthy in my personal opinion according to my own research + one of the most expensive*, (I personally pay $125/year, mostly to support them, but they do have a free tier plan as well), Tresorit.com. (they're a little slow, but they have cross platform clients first class support for linux, have Sweden based severs with legal protection against big brother snooping, solid reputation + history of existing since 2011.)
Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.