Linked Questions

0 votes
1 answer

how to break AES [duplicate]

why is breaking a (asymmetric) 1024 bit RSA key less difficult than breaking a 128 bit (symmetric) AES key? Breaking RSA key involves finding the prime factors of a large number. What is involved in ...
george s's user avatar
31 votes
3 answers

Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers

Given that much of our ECC crypto primitives provide “only” 128-bit security when defined over a 256-bit curve due to pollard-rho, is it then still safe in 2020 to consider 128-bit security safe for ...
Woodstock's user avatar
  • 1,374
40 votes
2 answers

Is AES-256 a post-quantum secure cipher or not?

We know Grover's algorithm speedup brute-force attacks two times faster in block ciphers (e.g brute-forcing 128-bit keys take $2^{64}$ operations, not $2^{128}$). That explains why we are using 256-...
AES256's user avatar
  • 417
41 votes
2 answers

Is AES-128 quantum safe?

I've been reading lately some contradicting messages with regards to the quantum-safe resistance of AES128. First, there are blog posts by Ericsson people like these ones: Can quantum attackers break ...
Jimakos's user avatar
  • 735
14 votes
5 answers

Does Grover's algorithm really threaten symmetric security proofs?

By Shannon's theorem of perfect security, if I give you a ciphertext 'LOUPL', you can do a brute-force attack and then you would find plaintexts like 'HELLO', 'APPLE', 'SPOON', but you can't ...
Victor Espinoza's user avatar
5 votes
11 answers

For Symmetric Cryptography, why is it considered more important to safeguard a key than the function/algorithm for encrypting/decrypting a message?

As stated for the question above here's an analogy: You are a robber looking for a house to rob with two different scenarios that might occur. 1. You have a key that you know belongs to a house and ...
omar7439's user avatar
15 votes
2 answers

How reassuring is 64-bit (in)security?

In Feb 2017, CWI and Google announced SHAttered hash collision attack on SHA1, which took $2^{63.1}$ work estimated 6500 CPU years, to achieve. Therefore, 64-bit should be considered now an insecurity....
DannyNiu's user avatar
  • 9,001
14 votes
1 answer

What are the rules for using AES-GCM correctly?

When using AES-GCM I know that I am supposed to use a new initialization vector every time I call the AES-GCM algorithm with the same key. What are other rules must be followed to use AES-GCM ...
ams's user avatar
  • 621
9 votes
1 answer

Security levels in NIST Post-quantum project: e.g. AES-128 vs SHA-256

In an article about NIST Post-quantum Standardization project I read about the security criteria of the proposed schemes and there was this table (Level I lowest security, level V highest): Level I: ...
gorte's user avatar
  • 167
9 votes
2 answers

What is a multi-target attack?

What exactly is a multi-target attack? How does the attack work on different cryptographic schemes (block ciphers, hash functions, elliptic curves)? How can it be avoided?
Conrado's user avatar
  • 6,404
6 votes
3 answers

Good layperson analogy for password and encryption keys

NOTE: QUESTION UPDATED. SEE BOTTOM OF THIS POST. I'm writing something where I need to make someone come across as though they know cryptography. I don't know enough, but as cryptography plays only a ...
Nicola's user avatar
  • 369
9 votes
2 answers

Why does NIST want 112-bit security from 128-bit key size for lightweight cryptography?

In NIST's Submission Requirements and Evaluation Criteria for the Lightweight Cryptography Standardization Process document it is stated that: 3.1 AEAD (Authenticated Encryption with Associated Data) ...
kelalaka's user avatar
  • 47.6k
6 votes
1 answer

Why GCM operation mode with AES-128 is recomended and can we use AES-192 and AES-256 with GCM?

It happens that on the internet I often find that AES encryption should use a 128-bit key only if it is used in conjunction with the GCM mode of operation. Why only with 128-bit keys? What happens ...
user avatar
3 votes
3 answers

When is a cipher considered broken?

We've all read how some people claim AES is broken because there was supposedly a way to get the plain text from a cipher text faster than brute-force. But is this the definition? Is a cipher broken ...
Vincent's user avatar
  • 966
4 votes
1 answer

Is encryption vulnerable to brute force cracking by quantum computers?

I am interested in cloud storage. It is using end-to-end encryption. It says that it uses AES-128 to encrypt files And there are more details in their white paper But I saw that quantum ...
le menhir's user avatar

15 30 50 per page