Menu
It seems there are legal issues associated with AES-256 (it is disabled in Java, and Oracle tells me in their UnlimitedJCE Policy that I am "advised to consult" my "export/import control counsel or attorney to determine the exact requirements" before turning it back on and the page on Wikipedia does not look very friendly either).
It also seems that AES-128 is "fine" (at least the people responsible for putting together the JDK have come to that conclusion).
So can I just use AES-128 and feel happy with my encryption? Is it still safe enough to protect the data for a couple of more years from all but the most resourceful attackers?
757
Out of 128-bit, 192-bit, and 256-bit AES encryption, which progressively use more rounds of encryption for improved security, 128-bit AES encryption is technically the least secure.
AES, which typically uses keys that are either 128 or 256 bits long, has never been broken, while DES can now be broken in a matter of hours, Moorcones says. AES is approved for sensitive U.S. government information that is not classified, he adds.
The EE Times points out that even using a supercomputer, a “brute force” attack would take one billion years to crack AES 128-bit encryption.
According to the Snowden documents, the NSA is doing research on whether a cryptographic attack based on tau statistic may help to break AES. At present, there is no known practical attack that would allow someone without knowledge of the key to read data encrypted by AES when correctly implemented.
Check this very simple website: http://www.keylength.com.
There you can find the various recommendations made by academic and private organizations across the world. They don't all say the same thing, but they are all in the same ballpark.
For instance, NIST claims that AES-128 is fine at the very least up to 2030.
52
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
