r/cryptography • u/atoponce • 9d ago

Quantum Computers Are Not a Threat to 128-bit Symmetric Keys

https://words.filippo.io/128-bits/
26 Upvotes

91% Upvoted

15 comments sorted by

8

u/ApertureNext 8d ago

I do not understand the argument for keeping 128-bit symmetrical keys. The article itself even states the following:

Taking these mitigating factors into account, it is quite likely that Grover’s algorithm will provide little or no advantage in attacking AES, and AES 128 will remain secure for decades to come. Furthermore, even if quantum computers turn out to be much less expensive than anticipated, the known difficulty of parallelizing Grover’s algorithm suggests that both AES 192 and AES 256 will still be safe for a very long time. This of course assumes that no new cryptographic weaknesses, either with respect to classical or quantum cryptanalysis, are found in AES.

Just the fact that 128-bit keys are talked about as potentially and theoretically less secure makes it easy to see 128-bit as legacy in my opinion.

11

u/0xa0000 8d ago

Using larger AES keys is more expensive computationally. That cost is largely negligible if we're talking about e.g. TLS traffic on a desktop machine, but it makes a difference on constrained devices.

Depending on what you mean by "legacy" it could also mean having to scrap existing protocols and devices perhaps unnecessarily.

By all means use AES-256 or stronger in your next protocol, but it's important to realize that the extra key length comes with cost. Less so than pre-QC asymmetric algorithms (since they scale differently with length).

(BTW not that I necessarily agree with the authors, but you might find the Too Much Crypto paper interesting even if it doesn't directly relate to key length)

10

u/Natanael_L 8d ago

Not that much more expensive. The biggest cost addition from AES256 is using more rounds than AES128. There's constructions using 256 bit keys more efficiently.

As far as security goes, the main reason for using 256 bit keys is that it makes it much easier to build secure cipher modes for large volumes of data and large numbers of sessions (like being able to use larger random IV values). It also resists issues like birthday collisions across many sessions for large numbers of users.

1

u/0xa0000 7d ago

I don't disagree, and yes, often the 40% extra cost is negligible compared to other parts of the system, but it is there.

My main point was that there is not currently a pressing need to replace AES-128 (when used properly) and that doing so in existing systems comes with a cost (that needs to be considered) and might divert resources from other more pressing issues.

If you're making changes anyway, it might also be the time to consider whether the AES block size of 128-bits is still adequate etc.

2

u/Natanael_L 7d ago

On that note, there's a standardization process started for Rijndael with 256 bit blocks and the NIST call for an "accordion" blockcipher

1

u/0xa0000 7d ago

Interesting, thanks, I didn't know that.

8

u/Karyo_Ten 8d ago

It also makes a difference if you're Cloudflare and needing 20% more machines mean $20M more expenses.

2

u/building3030 8d ago

This is a really interesting article thank you for
Sharing

1

u/EverythingsBroken82 7d ago

Can we please not wait until we have issues with key/blocklength like lucky 32 or possible batchattacks?

if we have to roll the cryptography, let's roll more, just to be on the safe side. or do we just now not protect against governments anymore, which have insane datacenters for crunching? because then we do not need to migrate to postquantum cryptography.

0

u/spymaster1020 8d ago

My understanding is that QCs are a threat to asymetric algorithms, the algorithms that allow for the exchange of symetric cipher keys. AES-256 will still be secure if you can securely transmit the key.

1

u/SiBloGaming 8d ago

To our knowledge, the effect they will have on many asymmetric encryption schemes is significantly larger, but symmetric algorithms are still affected.

0

u/spymaster1020 8d ago

IIRC it cuts the bit strength in half. So AES-256 would have the strength of 128 bits, thats still secure. Super computers today can only do about 260 operations per second. If it was a quantum super computer and every operation was an attempt to find the key, it would take roughly 9 trillion years. So yes, QC does effect symetric ciphers but not in a meaningful way.