Skip to main content
54 votes
Accepted

Is AES-128 quantum safe?

All of the above sources are correct; there is not a realistic threat to AES from Grover's algorithm. The headline statement of $2^{64}$ quantum operations is often misinterpreted because people think ...
Daniel S's user avatar
  • 24.2k
48 votes
Accepted

Is using the same IV in AES similar to not using an IV in the first place?

Lets see if I can clarify things for you. For one, the IV is not specifically related to AES at all. AES is a keyed invertible transform from a 128 bit value to a 128 bit value; that's all it can do....
poncho's user avatar
  • 149k
40 votes
Accepted

Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers

I strongly disagree with saying that AES-128 is broken, in any way, shape or form, and likewise ECC with 256-bit keys. Note that even in this answer by @kelaka regarding AES-128, you would need over ...
Yehuda Lindell's user avatar
38 votes

Rubik's Cube as Encryption

Can this be considered as Encryption If the sequence of necessary moves is treated as the key, yes. how secure can this encryption scheme be? First some details about the cube: 6 faces, ...
deviantfan's user avatar
  • 1,187
32 votes

Isn't AES-NI useless because now the key length need to be longer?

No, AES-NI provides a hardware implementation of AES. Before AES-NI, anyone could have purchased a specialized hardware encryption device that ran AES in hardware. So having AES-NI doesn't really ...
mikeazo's user avatar
  • 38.7k
29 votes

Why do web-services tend to use preshared secret keys for client authentication instead of public keys?

I don't think it makes sense to call these kinds of tokens "symmetric keys", because they are not encryption keys that are used as input to a symmetric cipher. They are bearer tokens that ...
David's user avatar
  • 390
26 votes

Is using the same IV in AES similar to not using an IV in the first place?

You shouldn't think of it as ‘using an IV with AES’. In fact, unless you are a cryptographer, you should forget that ‘AES’ itself exists as a thing: it is a pseudorandom permutation family $\...
Squeamish Ossifrage's user avatar
25 votes
Accepted

After ECDH with Curve25519, is it pointless to use anything stronger than AES-128?

The reasoning is wrong, because the scaling of attacks on AES is qualitatively different from the scaling of attacks on X25519. A successful multi-target attack on a system using AES-128—that is, an ...
Squeamish Ossifrage's user avatar
25 votes

Can Quantum Computers crack RSA and AES?

It's almost public knowledge by now. Quantum Computing (QC) does break existing asymmetric-key algorithms - those based on integer factorization and discrete-logarithm such as RSA, DH, ECDSA, etc. ...
DannyNiu's user avatar
  • 9,519
24 votes
Accepted

Is Caesar cipher perfectly secret?

Yes, because instead of a Caesar cipher you now have a One-time pad. In particular, it meets the requirements of a key that is random and as long as the message. So as long as the key is kept secret ...
Eugene Styer's user avatar
  • 1,676
24 votes

Why is the market for cryptographic primitives non-commercialized?

Are there more examples? About the only other example I can think of is Cryptography Research Inc (now owned by Rambus); however what they sell is methods of implementing primitives (in ways that are ...
poncho's user avatar
  • 149k
23 votes
Accepted

Is password-based AES encryption secure at all?

You are correct in that the best strategy for an adversary would be to guess the password, as opposed to cryptanalysis of AES plaintext/ciphertexts. However, this does not make encryption pointless - ...
Ella Rose's user avatar
  • 19.7k
23 votes

AES: Why is it a good practice to use only the first 16 bytes of a hash for encryption?

Why is it a good practice to use only the first 16 bytes of a hash for encryption? As you noted, it isn't. But, the problem is not with the "16 bytes" part of the statement, or the concern for ...
Ella Rose's user avatar
  • 19.7k
23 votes
Accepted

Why is the market for cryptographic primitives non-commercialized?

Offering a crypto technology for free is the easiest, and certainly one of the reason that's done. Alternatives are: Keeping it secret. Patenting it and selling licenses. An example of 1 is the ...
fgrieu's user avatar
  • 143k
20 votes
Accepted

Do key collisions for symmetric ciphers exist?

The number of possible permutations of a block cipher are $2^n!$ where $n$ is the block size. A permutation maps all $2^n$ possible input blocks to $2^n$ possible output blocks. A key, with key space $...
Maarten Bodewes's user avatar
  • 93.5k
19 votes
Accepted

Isn't AES-NI useless because now the key length need to be longer?

You might gain some perspective from reading up on specialized AES search hardware, like these two systems: COPACOBANA Its successor RIVYERA If you go to the second link and expand the "...
Luis Casillas's user avatar
19 votes
Accepted

What exactly does s2k do in gpg

The "s2k" options correspond to the String-to-Key specifiers. An s2k transform turns a human-compatible symmetric secret (a password or passphrase) into a symmetric key suitable for a ...
Thomas Pornin's user avatar
19 votes

Is 128-bit security still considered strong in 2020, within the context of both ECC Asym & Sym ciphers

As you specifically asked for comparisons of the 128-bit security with concrete things, here is some food for thoughts (to complement the other answers): $2^{61} ≈$ SHA-1 chosen-prefix collision (i.e....
Lery's user avatar
  • 7,749
18 votes

Is Caesar cipher perfectly secret?

What you described it not a Caesar cipher. A Caesar cipher is a cipher where all letters are shifted by the same number of positions. In the question text you are describing a shift cipher. This is ...
mentallurg's user avatar
  • 2,621
16 votes

What should the nonce value be for client-side encryption?

The library also uses XChaCha20Poly1305 and that requires a nonce of 192-bit (24-byte). It is an extension of ChaCha20Poly1305 ...
kelalaka's user avatar
  • 49.1k
15 votes

Do key collisions for symmetric ciphers exist?

Apparently there's at least one real-life example of a block cipher with equivalent keys: TEA has a few weaknesses. Most notably, it suffers from equivalent keys—each key is equivalent to three ...
ilkkachu's user avatar
  • 903
15 votes
Accepted

How to generate the exact AES key in both client and server side?

There are two main ways to have the same symmetric key on both parties: key exchange using asymmetric crypto generate the key from a known secret (eg: a password), such as using a password-based key-...
Marc's user avatar
  • 1,583
14 votes

Is password-based AES encryption secure at all?

Am I right? Is it completely pointless to use passwords to AES encrypt files? No, certainly it isn't completely pointless to use password to AES encrypt files. However, problem lies within details. ...
axapaxa's user avatar
  • 2,960
14 votes
Accepted

Post Quantum Symmetric Cryptography

AES-256 is still considered the strongest (and is considered secure) as related key attacks are not particular to analysis with quantum computers. Related key attacks could happen when AES is used ...
Maarten Bodewes's user avatar
  • 93.5k
14 votes

For a typical n-bit symmetric key, how many keys would be considered too weak to use?

I understand that all zeros or all ones would be weak for any cipher. This isn't actually true. For good cipher there are no weak keys. And certain ciphers, e.g. DES, have a list of weak keys. But ...
axapaxa's user avatar
  • 2,960
14 votes

For Symmetric Cryptography, why is it considered more important to safeguard a key than the function/algorithm for encrypting/decrypting a message?

Some facts for you to consider: Brutal-force a cryptographic key is much harder than brutal-force breaking into a house - the former can take as long as for a star to explode, while the latter take ...
DannyNiu's user avatar
  • 9,519
13 votes
Accepted

Symmetric cipher key size vs number of rounds. Longer key = more secure cipher?

With enough plaintext/ciphertext available (sizably more plaintext than keysize), any cipher can be attacked by trying all the keys; that's brute force. Therefore, for any cipher, too short key ⟹ ...
fgrieu's user avatar
  • 143k
13 votes

Explaining Chaotic Cryptography

Explain the problem that the solution of "chaotic cryptography" is intended to solve You have the question tagged with encryption, cryptanalysis, and symmetric. So it sounds like it is a method of ...
Ella Rose's user avatar
  • 19.7k
13 votes
Accepted

Does symmetric key cryptography usually include hash function?

From what point of view can hash functions be classified as symmetric key cryptography? Hash functions do not use public/private key pairs, thus are not asymmetric cryptography (though they are ...
fgrieu's user avatar
  • 143k
13 votes

For Symmetric Cryptography, why is it considered more important to safeguard a key than the function/algorithm for encrypting/decrypting a message?

At least two reasons. 1: security. You want your algorithm to be a good one. One of the best ways we know of ensuring cryptographic algorithms are good is to have as many experts as possible assess ...
ignis volens's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible