1
$\begingroup$

In today's world of applications, I see a lot of the time a 256-bit encryption key is used, but what about an 80 or 128? What makes 256 the one to use. Is a 80 or 128 easily decrypted?

Are comp ciphers better than others with the encryption of these keys?

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ The last question is not clear! $\endgroup$
    – kelalaka
    Feb 28, 2021 at 14:15
  • 3
    $\begingroup$ Could you try and edit the last section of the question to make it more clear? Generally, we don't aim to avoid ciphers that are not easy to decrypt, we aim to use ciphers that are computationally hard to decrypt without the key. How easy it is to decrypt something depends on the adversary as well. "Easy" is different for the NSA, cryptographers, hackers, general computer users and finally computer illeterates. $\endgroup$
    – Maarten Bodewes ♦
    Feb 28, 2021 at 14:57

2 Answers 2

Reset to default
8
$\begingroup$

80-bit

First, note that the Bitcoin miner's hash rate reached $> 2^{93}$ SHA-256 hashes per year in February 2021. This makes the 80-bit security absolute for known entities. They even passed that years ago (that is around 2012 per year). And even around 2011, it was absolute and NIST increased security strength from 80 to 122 for Federal Government in 2014. So there is no place for 80-bit in today's security.

128-bit

For 128-bit the question a bit more interesting, while yet there cannot be a group that can reach $2^{128}$ complexity ($2^{35}$-year is needed for a power like the Bitcoin Miners). There are

  • multi-target attack

    In short; The expected cost of finding a key from $t$ targets is $2^{128}/t$. If you have a billion targets that you will be able to find the first key much lower than 128-bit security. The cost would be below $2^{100}$ and the time would be below $2^{70}$.

  • quantum-based attacks due to Grover's quadratic speed algorithm on symmetric ciphers. If ever build and if we omit other costs, 128-bit has 64-bit symmetric security on quantum computers.

Or see what can be done to AES-128

256-bit

To mitigate all just use AES-256 (or any 256-bit secure cipher like ChaCha20) and that is already the golden standard by the industry. Brute-force is impossible, multi-target has no meaning, and Grovers's algorithm can just reduce the security to 128-bit. Now we are safe as long as there no breakthrough either in breaking the algorithms or find a new scientific advancement.

112-bit

For lightweight cryptography NIST required at least 112-bit security from the 128-bit key size.

Improve this answer
$\endgroup$
0
2
$\begingroup$

256-bit symmetric keys can be brute-forced by a General Purpose Quantum Computer in $2^{128}$ operations with Grover's algorithm. For 128-bit keys, only $2^{64}$ operations are needed. So if someone ever manages to build a general purpose quantum computer large enough (it's not entirely clear that it's possible) 256-bit keys will remain secure, but 128-bit keys won't.

Classical computers in large numbers can already brute-force 80-bit keys.

Classical computers would be unable to break 128-bit keys within the next few million years. Multi-target attacks could be an issue though, but they aren't for 256-bit keys.

256-bits provides security for millions of years of brute-force attempts by a quantum computer network made out the entire mass of the Earth. It's also small enough and with good enough performance to be usable. 256-bits is a good tradeoff between performance and security.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.