We've all already turned off RC2, RC4, DES, IDEA, and more. We are down to just 3DES and its replacement, AES. With the new BWAIN threatening 3DES (and blowfish), we seem to just have AES (and maybe the not-always-supported Camellia.

So, when we get a new BWAIN that AES is broken, what then? Seriously. We are turning off these things faster than they are being made.

  • At the moment the we are switching off AES-128 in favor of AES-256. And now the thing is, AES is good because it became standard so there's hardware acceleration for it. Unless there's someone defiant like Google to use something else (like ChaCha20-Poly1901), it won't go away as there's no good reason to do so. However, Key Exchange protocols will have to replaced ASAP. The problem is with the prime numbers (they are not considered safe anymore long-term) and secondly there aren't well developed alternatives, e.g. it will take some time to settle on some good standard.
    – Aria
    Commented Aug 26, 2016 at 20:53
  • 2
    @Aria, MikeP ChaCha20 or any Salsa may replace AES as stream cipher, but not for anything else. Disk encryption will still use AES in the next few years. Surprisingly AES has withstand all attacks so far, and even 256bit is post-quantum secure. I don't think we'll see any AES replacements soon. Commented Aug 26, 2016 at 21:44

1 Answer 1


TLS 1.3, which is still a draft, is going with two authenticated ciphers as its required choices:

  1. AES-GCM, with either 128- or 256-bit keys;
  2. ChaCha20/Poly1305

The reasons we have two are the following:

  1. As a backup—if one of them is broken, everybody can switch to the other;
  2. They have different strengths:
    • AES-GCM has excellent hardware support in many platforms;
    • ChaCha20/Poly1305 has faster all-software implementations than AES-GCM does.

So the answer is that if somebody tomorrow broke AES, we would all probably switch to ChaCha20/Poly1305 and try to quickly find another backup alternative. There's an ongoing competition to design a new authenticated cipher, so there's some chance that some finalist from that might get picked up in the 2020s.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .