A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

# Tag Info

8

As you specifically asked for comparisons of the 128-bit security with concrete things, here is some food for thoughts (to complement the other answers): $2^{61} ≈$ SHA-1 chosen-prefix collision (i.e. definitively practical) from the recent SHA-mbles attack. $2^{63} ≈$ the initial SHA-1 collision from SHAttered attack (which ran over multiple months). (i.e. ...

8

The current recommendations of the BSI recommend 120 bit of security beyond 2022. And AES 128 is still in their recommendations. If the current estimate of AES128 is about 126.1 bits of security, that's still above the threshold. And AES has been subject to a lot of cryptanalysis for many years, so that estimate seems quite strong. For crypto with keys, ...

22

I strongly disagree with saying that AES-128 is broken, in any way, shape or form, and likewise ECC with 256-bit keys. Note that even in this answer by @kelaka regarding AES-128, you would need over 34 million years of the entire bitcoin mining power to carry out a computation of $2^{128}$. This is far from broken. If quantum computers ever happen at scale, ...

0

The system is either insecure or horribly insecure. When using Xor, an attacker with two ciphertexts can xor them, eliminating the key and getting the Xor of two plaintexts. You said plaintexts are all distinct and 256 bits, if they are chosen uniformly at random, getting the XOR of two of them is obviously not desireable but doesn't immidiately reveal the ...

1

This appears to be a one time pad cipher, turned into a multi time pad cipher, as the key remains the same for every different plaintext that is entered. This is a broken construction then - look at the "Use and Security" tab of your wiki link. If AES for example is used, say CTR mode, using a counter, then it is secure, as long as the counter never repeats ...

3

The shared symmetric key is the same for all users? The shared key is exactly the same for each user, assuming they are connected to the same WEP access point. Because the nonce is concatenated with the key and fed directly into RC4, each wireless frame is technically using a different key (at least until the small 24-bit nonce repeats). This is unlike 802....

0

Messages 4 and 5 are meant to protect the recipient B from a replay attack. It is a basic challenge response mechanism. Otherwise an attacker could just replay previous messages and have the very same interaction with B again. That is bad, if e.g. the message is just "increase some counter", or another message that has a lasting effect or changes a state. ...

Top 50 recent answers are included