1

AES-256, as far as I know, generates an 256 bit key to encrypt a message, and the 256-bit key is generated by a known algorithm starting from the password the user chooses. Since the encryption is symmetrical, though, any user inputting the same password will be able to generate an equal 256-bit key that decrypts the archive.

So how is using AES-256 safer than, say, AES-128? Doesn't an attacker just need to brute-force or use other attacks (like dictionary) in order to guess the password in both cases?

  • Are you asking how AES-256 protects better than AES-128 since all you need to do is to know the password? Passwords are not the only thing to brute force. – schroeder Sep 28 '18 at 13:45
  • Done. And yes, mostly. – Eärendil Baggins Sep 28 '18 at 13:47
  • 1
    Keys can be randomly generated (and should be if possible). Exceptionally good passwords can have more than 128 bits of entropy. – AndrolGenhald Sep 28 '18 at 13:49
  • Then the user doesn't really have all of the security AES-256 offers in protocols where he uses a password to generate the key instead of randomly generating it and inputting thst every time? – Eärendil Baggins Sep 28 '18 at 13:51
  • @schroeder What else do you bruteforce other than the password and the key itself (in which case it's obvious why 256 bit is better)? – Eärendil Baggins Sep 28 '18 at 13:53
2

You're confusing the AES encryption with key derivation.

If you use key derivation mechanism that derives the key from a password then the effective strength of the resulting encryption is the weaker of both the encryption and key derivation step.

If your password contains less than 128-bit strength (this is equivalent to about 21 characters passwords randomly chosen from a 64 character set, or about 9-words diceware passphrase), then yes your derived key will only have at most that many bit of strength, thus AES-256 will not improve on AES-128. But if you have a stronger password, then 256-bit AES can preserve more of the strength from the original password.

Mathematically, AES-256 is harder to crack than AES-128 when used with appropriate key derivation and password generation. Although in practice, 128-bit is already practically not brute forceable, so in practice using more than 128-bit passwords is overkill for most situations. The main purpose of 256-bit passwords and AES-256 is really just to increase the security margin of the scheme if it turns out that there is a cryptographic flaw that reduces the strength of the system.

Also, there are a lot of applications of AES where the key is not just derived from a password. For example, if the key is stored in a secure cryptoprocessor/smartcard, which can enforce lock down policy by forcing delays between attempts. There are also hybrid schemes where the system generates a 256-key that is then encrypted with a password, and the encrypted key is not stored together with the data, so that opening the encryption requires an out of band header.

  • If you look at the OP's comment "I'm thinking about a 32 characters" to my answer it seems the OP is not using key derivation. – zaph Sep 28 '18 at 17:14
  • If key derivation is being used the brute force is against that, not the encryption and there is little difference in decryption speed between AES-128 and AES-256. Further when brute forcing encryption only a block or so need be decrypted in order to determine if the key is incorrect. – zaph Sep 28 '18 at 17:18
  • 1
    @zaph: it seems, like OP, you also are confusing key derivation and encryption. Also, there's no such thing as using a password and not using key derivation. A trivial binary decoding is still a key derivation function, even when there's no key stretching involved. – Lie Ryan Sep 28 '18 at 17:28
  • @zaph My main point is that AES-128 can only effectively use up to 128-bit passwords. Any higher strength passwords than that won't make AES-128 harder to crack. OTOH, AES-256 can use passwords that are more than 128-bit strong effectively, up to 256-bit passwords. – Lie Ryan Sep 28 '18 at 17:34
  • 1. I am not confusing key derivation and encryption. Key derivation is not to be confused with encodings, among other properties one is not reversible the other is. Just passing a pointer to an ASCII string is not key derivation. 2. In what existing scenario is a 128-bit key weaker than a 256-bit key given that neither can be brute forced. – zaph Sep 28 '18 at 18:14
1

AES-256 is currently no more secure than AES-128, given a random key neither is brute forcible.

If and/or when quantum computing becomes available AES-128 will no longer be sufficiently secure and AES-256 will remain secure.

If a password is being used that is the limiting factor. Using a secure key derivation method helps by imposing CPU utilization of ~100ms thus substantially reducing the success of brute force password attacks.

  • 1
    What do you mean by 100 ms? Also, does using a long and enough random password (256 bits is 32 bytes so I'm thinking about a 32 characters one) grant about the same security as choosing a 256 bit random key? – Eärendil Baggins Sep 28 '18 at 14:47
  • 1
    1. Key derivation methods such as PBKDF2 have a rounds argument and current practice is to choose that such that the derivation consumes approximately 100 milliseconds of CPU time. Thus reducing brute force attempts by a factor of 10,000 times or more. 2. 32 random displayable ASCII characters has about 96^256 bits of security which is sufficient. But the catch is "random characters". – zaph Sep 28 '18 at 15:02
  • 1
    @EärendilBaggins You'll have to use the full range of bytes, not just ASCII printable characters, if you want to use the full strength of AES-256 with a 32-character password (to match a 256-bit key). If you're using 96 printable ascii characters, you'll actually need a 39 characters password (log(2**256)/log(96) = 38.87...) – Lie Ryan Sep 28 '18 at 17:42
  • On the other hand AES-128 can not be brute forced so for 128-bit security with random characters in a set of 96 20 characters will provide that. (log(2**128)/log(96) = 19.43) – zaph Sep 28 '18 at 18:09
  • @Lie Ryan Can I use a 39 characters password to generate a 256-bit key though? – Eärendil Baggins Oct 9 '18 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.