Timeline for After How Much Data Encryption (AES-256) we should change key?
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 26, 2013 at 22:34 | comment | added | Tom Leek | It is not true when said that way. 3DES does not "require" a key change that often -- it is just that if you change the key that often and you believe 3DES to be an ideal 64-bit cipher then you benefit from a rather strong proof of security. If you use your key beyond these 2^16 blocks then your system won't be immediately broken, but you cease to be protected by the big umbrella proof of security. Since the proof is itself based on rather questionable assumption, that's no big deal. | |
| May 21, 2013 at 16:04 | comment | added | makerofthings7 | Is it true that 3DES requires a key change at less than 0.5 MB? | |
| Feb 3, 2013 at 21:08 | comment | added | tylerl | @DeepeshM Often it comes from a frustrating experience such as a compromise due to a password disclosure years ago which wasn't actually found and exploited until months or years later, and which persisted for perhaps years after that. Such a problem clearly is resolved/prevented through password expiry, but expiring passwords creates its own problems too. | |
| Feb 3, 2013 at 17:16 | comment | added | ewanm89 | @DeepeshM it's mostly out of a misguided notion that if it is compromised, it is only compromised for a maximum of 90 days when the keys are all changed. Therefore limiting the breach to that period. Of course, unless the initial breach is fixed, all the attacker has to do is repeat every 90 days to compromise the new keys. If he didn't add a backdoor in the first time. | |
| Feb 3, 2013 at 15:01 | comment | added | Tom Leek | @DeepeshM: it is Cargo Cult. They do that out of some imagined but not clearly defined security benefit. In most places password renewal is enforced because it is supported by the system, and they consider that whatever is supported MUST be "good" in some way or another. See this question for longer discussions on the subject. | |
| Feb 3, 2013 at 14:52 | comment | added | Deepesh M | A followup question - why then some of business process press on rotating keys after 90 days? | |
| Feb 3, 2013 at 11:58 | comment | added | CodesInChaos | @ewanm89 A 64 bit IV only allows around 2^32 messages unless you keep state between messages, which is often problematic. Works fine for encrypting a single connection, but it's quite risky for long term secrets. | |
| Feb 3, 2013 at 0:40 | comment | added | ewanm89 | @CodesInChaos well, that also depends on block mode, but lets guess it's one where a sequentially increasing iv (say CTR mode), all we need do is use a >=64bit long IV, and we'll also be at 2^64 blocks before that repeats. | |
| Feb 2, 2013 at 20:10 | comment | added | CodesInChaos | Aren't the practical problems more about IV/nonce collisions and thus reuse and less about detecting the difference between PRP and PPF? | |
| Feb 2, 2013 at 19:33 | history | answered | Tom Leek | CC BY-SA 3.0 |