36 votes
Accepted

Largest integer factored by Shor's algorithm?

wondering what the largest integer is which they were able to factor with a small quantum computer Stunts Before the present answer, the largest claim for quantum-related factoring seems to have been ...
31 votes

What is the maximum size of the plaintext message for RSA OAEP?

The input length of OAEP is directly specified in the standard: ...
user avatar
  • 84.5k
24 votes
Accepted

Argon2 output length and parameter storage?

You need to consider the weakest link property: a security system is never stronger than its weakest link. Since Argon2 is a password-based function, the weak link here is going to be the strength of ...
user avatar
22 votes
Accepted

1 Billion Bit Encryption?

Examining his claims about "Thundercloud": You can use it with "any existing software, operating system, or device" (a massive amount of effort---by whom?) Has its "own cryptographic language that is ...
user avatar
  • 6,639
21 votes

What size should the HMAC key be with SHA-256?

The only rule for the key is that it should at least contain 256 bits of randomness. If the key is smaller you may not get the full security of HMAC-SHA-256. The full security of HMAC is basically ...
user avatar
  • 84.5k
21 votes

What is the minimum and maximum value of an RSA private exponent?

In summary: Modern practice is to fix a small public exponent $e$ such as $e=2^{(2^4)}+1=65537$, then choose a public modulus $N$ of $\text{nlen}$ bits (the key size) with large random prime factors ...
user avatar
  • 122k
20 votes

What is the history of recommended RSA key sizes?

512 bits (rounded down from the 664 bits or 200 digits in the patent) was recommended from its conception in 1974 and throughout the 1980s. Indeed, 463 bits was considered sufficient in the mid-1990s ...
user avatar
17 votes
Accepted

What is the maximum key size for a 128 bit AES?

Despite similarities, it is really important to understand that passwords and cryptographic keys should not be carelessly conflated. Some important contrasts: Passwords are normally selected by ...
user avatar
14 votes

Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?

SHA-512 has both a larger internal state and a higher number of rounds than SHA-256 - which means that it provides a higher bit strength. Somewhat surprisingly it may also outperform SHA-256, as it ...
user avatar
  • 84.5k
14 votes

Brute-forcing Symmetric Keys

No, it doesn't help. It doesn't hurt either; as long as you don't repeat keys, the probability of success is always the same. That is, if there are $2^n$ possible keys, and you test $\lambda$ of ...
user avatar
  • 131k
13 votes
Accepted

How do I get the equivalent strength of an ECC key?

The security level of an elliptic curve group is approximately $\log_2{0.886\sqrt{2^n}}$. You can use this to approximate the security level of a $n$-bit key, eg: $\log_2{0.886\sqrt{2^{571}}} = 285....
user avatar
13 votes
Accepted

Password entropy much lower than entropy of encryption keys. Why is this acceptable?

I know that humans would find it impossible to maintain a 128 bit password -- however, I wonder if there is some technical reason why a 52 bit password would not be as weak as a 52-bit encryption key ...
user avatar
  • 31.2k
13 votes

What is the purely mathematical definition of encryption strength?

There isn't just one, because there are many different scenarios where you'd use such a function, where the attacker has lesser or greater powers, or variably stringent success goals—different attack ...
user avatar
12 votes
Accepted

Why can't we give block ciphers larger keys?

I saw many people complainig about AES , twofish and serpent that these ciphers all could be crackable in the near future and even today with big datacenters . This is a good example of why we should ...
user avatar
  • 19.2k
11 votes

Is RSA key size the size of private key exponent?

No, the RSA key size is not the size of the private key exponent. It is customarily the number of bits in the public modulus (which is known as $N$). In other words, the key size is the integer $k$ ...
user avatar
  • 122k
11 votes

Key sizes supported by 3DES

The triple DES (3DES) block cipher works by essentially running the block through DES three times. Triple DES is also known as "DES EDE" (encrypt-decrypt-encrypt) and under the name given by the ...
user avatar
  • 131k
11 votes
Accepted

80-bit collision resistance because of 80-bit x87 registers?

Coprocessors are designed for improved performance in a certain case, and in the case of fixed-width mathematics, I do not believe you would see a performance increase. I am quite sure that 80-bits ...
user avatar
  • 4,212
10 votes

What is the maximum key size for a 128 bit AES?

AES-128 requires keys 128 bits in length, period. As Thomas points out in his comment, the size of characters is encoding-dependent, so there is no well-defined "number of characters" in an AES key. ...
user avatar
10 votes

Why can't we give block ciphers larger keys?

I saw many people complainig about AES , twofish and serpent that these ciphers all could be crackable in the near future and even today with big datacenters Let me go through some of the lesser ...
user avatar
  • 131k
10 votes

Nexor, an encryption algorithm that promises unlimited key sizes: Is it safe?

Looking very briefly at the source, it's just using the output of /dev/urandom to generate keys, then using that as a (poor) One-Time Pad. /dev/urandom is just a ChaCha20-based RNG with some decent ...
user avatar
9 votes

How big an RSA key is considered secure today?

An adversary with a moderately large quantum computer to run Shor's algorithm will cut through a 1024-bit RSA modulus like a hot knife through butter, and maybe through a 2048-bit RSA modulus like a ...
user avatar
9 votes

How Secure is gpg Command Using Symmetric AES-256 From Being Cracked

GPG's AES-256 symmetric encryption is believed to be as secure as it is difficult to guess the passphrase or compromise the machine used to perform encryption and decryption. Guessing the passphrase ...
user avatar
  • 122k
9 votes

80-bit collision resistance because of 80-bit x87 registers?

The original SHA-1 and Skipjack specifications did not provide a justification for using a 80-bit key size, so we can only speculate about the reasons. However, it is important to understand that ...
user avatar
  • 35.3k
8 votes
Accepted

Is AES key length a size of the key or entropy?

When they say they are using a 128 bit AES key, they mean the length of the key is 128 bits. Technically a 128 bit AES key could have 0 bits of entropy, 128 bits of entropy, or anywhere in between. ...
user avatar
  • 37.7k
8 votes

Why is Rijndael key length restricted?

The key schedule uses constants that differ between the key sizes. For arbitrary sized keys you would have to define an algorithm for deriving them. Each key size also uses a different number of ...
user avatar
  • 31.2k
8 votes
Accepted

Can there be a need for 1024-bit (symmetric) encryption?

In order to answer this question, we need to understand the basis behind all of modern cryptography, which is computational hardness. Today, we believe that we know how to construct block ciphers that ...
user avatar
8 votes

Key Size for Symmetric Homomorphic Encryption Over the Integers

The paper says that the parameters are $r ≈ 2^{\sqrt \eta}$ and $q ≈ 2^{\eta^3}$. Note that these values are expressed as functions of $\eta$, not $N$. With regard to the parameters, it is common ...
user avatar
  • 4,822
8 votes
Accepted

For RSA keys, is the safety of a given key-length different for signing vs encryption?

No, the security is about identical, as the underlying RSA problem is the same. Besides that, non-repudiation is usually managed differently with regards to legal requirements. Providing ...
user avatar
  • 84.5k
8 votes
Accepted

How secure is AES-256, but with an effective key length of 56-bits?

It would appear that this is as a consequence of the Wassenaar Arrangement (more detailed explanation). Basically, because cryptography falls under certain laws regarding munitions and arms ...
user avatar
  • 3,952
8 votes

What is the purely mathematical definition of encryption strength?

One of the definition is stated in the other answer (indistinguishably). Another way to assert the strength of an algorithm is to compute the complexity of an attack. Let us assume $$E : \mathcal{K} \...
user avatar
  • 9,789

Only top scored, non community-wiki answers of a minimum length are eligible