Essentially I'm asking, what if I have designed a quantum-proof stream cipher that is faster than AES-256?

Will using less computational power for encryption/decryption be valuable to companies or various organizations?

I can imagine that faster and lighter encryption while secure enough could potentially cut down costs or give a competitive advantage to a business. (like Google)

However, I would highly appreciate it if you can bring up a few examples that the value of this could make someone pay for a more efficient* encryption algorithm.

*Faster, more secure & using less computational power.

  • 1
    $\begingroup$ Decryptiyon who needs that? GCM(CTR) mode is now the gold. Have you ever heard the ChaCha/Salsa series, built-in CTR? There are candidates already but they are not NIST standard. Google already uses ChaCha. Any block cipher uses 256-bit of key is secure against Grover! And currently, the Salsa have better security than AES, yet none with 256-bit of key is expected to be broken $\endgroup$
    – kelalaka
    Commented Oct 7, 2021 at 19:42
  • 4
    $\begingroup$ Usually, we don't pay for a cipher, we just find another one to use! $\endgroup$
    – kelalaka
    Commented Oct 7, 2021 at 19:44
  • 3
    $\begingroup$ "what if I have designed a quantum-proof stream cipher that is faster than AES-256?"; the question that is always asked is "why should we believe that it's secure?". Unless you can come up with a really good answer to that (one better than, well, "I thought about it really hard and couldn't think of a way to break it myself" or "I ran a bunch of statistical tests on the outputs and those tests said it looked random"), no one will touch it... $\endgroup$
    – poncho
    Commented Oct 7, 2021 at 21:20
  • $\begingroup$ Kelalaka is right, even a very efficient algorithm such as OCB failed miserably, and that was just because of a relatively patent issue (not free for military use). Cryptographers really don't like patents, we just code around them. $\endgroup$
    – Maarten Bodewes
    Commented Oct 17, 2021 at 23:31

1 Answer 1


The obvious market for such a cipher is for lightweight internet-of-things devices where production costs need to be kept small and battery life needs to be maximised (e.g. if device access is hard such as with a pacemaker or satellite component). Minimising the circuit size and power consumption in these constrained circumstances is highly desirable.

It is for these reasons that NIST is in the final stages of a process to choose such a cipher suitable for standardisation. In other words, you should aim to be more efficient than the winner(s) of this process rather than AES. Even then the economic savings would have to be significant for implementors to assume the potential liability associated with a non-standard algorithm.

  • $\begingroup$ Well, NIST required at leas 112-bit security not 128. $\endgroup$
    – kelalaka
    Commented Oct 7, 2021 at 20:22
  • $\begingroup$ Also of note is the EU stream cipher competition (ECRYPT 2 / eStream), although it is a bit older. $\endgroup$
    – Maarten Bodewes
    Commented Oct 17, 2021 at 23:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.