Skip to main content
Information Security

Return to Answer

replaced http://security.stackexchange.com/ with https://security.stackexchange.com/
Source Link
Community Bot
Community Bot
  • 1

128-bits should be enough entropy - see this answerthis answer. Quantum computers may change this, but that's still theoretical.

It appears to be (relatively) easy enough to design a symmetric cipher where the only effective attack is brute force. AES has withstood some years of cryptanalysis and there are many other ciphers.

Asymmetric crypto generally needs much larger keys for equivalent security.

For hashes, and specifically for collision resistance, we need to worry about the birthday attack. In rough terms, than means a hash needs to be twice as long as the equivalent symmetric cipher. So SHA-256 is a good match for AES-128.

I should point out that both MD5 and SHA-1 had cryptographic breaks - the attacks are better than brute force. SHA-1 is a 160-bit hash, so brute force (with birthday attack) would require 2^80 operations, but the published attack used more like 2^64. It may turn out that SHA-256 has cryptographic weaknesses, but they would have to be significantly better than brute force to make an attack practical.

128-bits should be enough entropy - see this answer. Quantum computers may change this, but that's still theoretical.

It appears to be (relatively) easy enough to design a symmetric cipher where the only effective attack is brute force. AES has withstood some years of cryptanalysis and there are many other ciphers.

Asymmetric crypto generally needs much larger keys for equivalent security.

For hashes, and specifically for collision resistance, we need to worry about the birthday attack. In rough terms, than means a hash needs to be twice as long as the equivalent symmetric cipher. So SHA-256 is a good match for AES-128.

I should point out that both MD5 and SHA-1 had cryptographic breaks - the attacks are better than brute force. SHA-1 is a 160-bit hash, so brute force (with birthday attack) would require 2^80 operations, but the published attack used more like 2^64. It may turn out that SHA-256 has cryptographic weaknesses, but they would have to be significantly better than brute force to make an attack practical.

128-bits should be enough entropy - see this answer. Quantum computers may change this, but that's still theoretical.

It appears to be (relatively) easy enough to design a symmetric cipher where the only effective attack is brute force. AES has withstood some years of cryptanalysis and there are many other ciphers.

Asymmetric crypto generally needs much larger keys for equivalent security.

For hashes, and specifically for collision resistance, we need to worry about the birthday attack. In rough terms, than means a hash needs to be twice as long as the equivalent symmetric cipher. So SHA-256 is a good match for AES-128.

I should point out that both MD5 and SHA-1 had cryptographic breaks - the attacks are better than brute force. SHA-1 is a 160-bit hash, so brute force (with birthday attack) would require 2^80 operations, but the published attack used more like 2^64. It may turn out that SHA-256 has cryptographic weaknesses, but they would have to be significantly better than brute force to make an attack practical.

Source Link
paj28
paj28
  • 34.7k
  • 10
  • 103
  • 139

128-bits should be enough entropy - see this answer. Quantum computers may change this, but that's still theoretical.

It appears to be (relatively) easy enough to design a symmetric cipher where the only effective attack is brute force. AES has withstood some years of cryptanalysis and there are many other ciphers.

Asymmetric crypto generally needs much larger keys for equivalent security.

For hashes, and specifically for collision resistance, we need to worry about the birthday attack. In rough terms, than means a hash needs to be twice as long as the equivalent symmetric cipher. So SHA-256 is a good match for AES-128.

I should point out that both MD5 and SHA-1 had cryptographic breaks - the attacks are better than brute force. SHA-1 is a 160-bit hash, so brute force (with birthday attack) would require 2^80 operations, but the published attack used more like 2^64. It may turn out that SHA-256 has cryptographic weaknesses, but they would have to be significantly better than brute force to make an attack practical.