Linked Questions

24
votes
3answers
16k views

Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers

Given that much of our ECC crypto primitives provide “only” 128-bit security when defined over a 256-bit curve due to pollard-rho, is it then still safe in 2020 to consider 128-bit security safe for ...
13
votes
2answers
3k views

How reassuring is 64-bit (in)security?

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity....
6
votes
3answers
2k views

Good layperson analogy for password and encryption keys

NOTE: QUESTION UPDATED. SEE BOTTOM OF THIS POST. I'm writing something where I need to make someone come across as though they know cryptography. I don't know enough, but as cryptography plays only a ...
8
votes
2answers
1k views

Why does NIST want 112-bit security from 128-bit key size for lightweight cryptography?

In NIST's Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process document it is stated that: 3.1 AEAD (Authenticated Encryption with Associated Data) ...
8
votes
1answer
1k views

Security levels in NIST Post-quantum project: e.g. AES-128 vs SHA-256

In an article about NIST Post-quantum Standardization project I read about the security criteria of the proposed schemes and there was this table (Level I lowest security, level V highest): Level I: ...
2
votes
3answers
3k views

When is a cipher considered broken?

We've all read how some people claim AES is broken because there was supposedly a way to get the plain text from a cipher text faster than brute-force. But is this the definition? Is a cipher broken ...
9
votes
1answer
1k views

Outlook of trustworthiness of SHA-2

On the Wikipedia page of SHA-2, the following is written: Currently, the best public attacks break preimage resistance for 52 out of 64 rounds of SHA-256 or 57 out of 80 rounds of SHA-512, and ...
4
votes
1answer
867 views

Is Mega.nz encryption vulnerable to brute force cracking by quantum computers?

I am interested in Mega.nz cloud storage. It is using end-to-end encryption. It says that it uses AES-128 to encrypt files And there are more details in their white paper But I saw that quantum ...
2
votes
1answer
5k views

Why GCM operation mode with AES-128 is recomended and can we use AES-192 and AES-256 with GCM?

It happens that on the internet I often find that AES encryption should use a 128-bit key only if it is used in conjunction with the GCM mode of operation. Why only with 128-bit keys? What happens ...
3
votes
2answers
1k views

What is a multi-target attack?

What exactly is a multi-target attack? How does the attack work on different cryptographic schemes (block ciphers, hash functions, elliptic curves)? How can it be avoided?
1
vote
5answers
375 views

Is it theoretically possible to create an unbreakable cipher?

I know this question might sound strange, but is it theoretically possible to create an unbreakable cipher if we don't consider bruteforce? Some of us believe that it is possible to create ciphers and ...
1
vote
2answers
216 views

80-bit vs 128-bit security in today's world

In today's world of applications, I see a lot of the time a 256-bit encryption key is used, but what about an 80 or 128? What makes 256 the one to use. Is a 80 or 128 easily decrypted? Are comp ...
4
votes
1answer
716 views

What are the rules for using AES-GCM correctly?

When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
2
votes
1answer
2k views

What are the known weaknesses in AES and is it being considered for upgrade or replacement? [closed]

I was at a conference earlier this week sponsored by a library about data archiving. The conference was not about cryptography. One of the speakers said that the Advanced Encryption Standard (AES) was ...
3
votes
2answers
322 views

If P256 ECDH shared secret contains ~128 bits of security, does using first half of the secret (= 128 bits) contain only 64 bits of security?

There's this rather popular open source project (I'd rather not name it before possible responsible disclosure) that computes a P256 ECDH shared secret (256 bits) and uses only first half of it, rams ...

15 30 50 per page