2

AES-256, as far as I know, generates an 256 bit key to encrypt a message, and the 256-bit key is generated by a known algorithm starting from the password the user chooses. Since the encryption is symmetrical, though, any user inputting the same password will be able to generate an equal 256-bit key that decrypts the archive.

So how is using AES-256 safer than, say, AES-128? Doesn't an attacker just need to brute-force or use other attacks (like dictionary) in order to guess the password in both cases?

Improve this question
6
  • Are you asking how AES-256 protects better than AES-128 since all you need to do is to know the password? Passwords are not the only thing to brute force.
    – schroeder ♦
    Commented Sep 28, 2018 at 13:45
  • Done. And yes, mostly.
    – Eärendil Baggins
    Commented Sep 28, 2018 at 13:47
  • 1
    Keys can be randomly generated (and should be if possible). Exceptionally good passwords can have more than 128 bits of entropy.
    – AndrolGenhald
    Commented Sep 28, 2018 at 13:49
  • Then the user doesn't really have all of the security AES-256 offers in protocols where he uses a password to generate the key instead of randomly generating it and inputting thst every time?
    – Eärendil Baggins
    Commented Sep 28, 2018 at 13:51
  • @schroeder What else do you bruteforce other than the password and the key itself (in which case it's obvious why 256 bit is better)?
    – Eärendil Baggins
    Commented Sep 28, 2018 at 13:53

2 Answers 2

Reset to default
3

You're confusing the AES encryption with key derivation.

If you use key derivation mechanism that derives the key from a password then the effective strength of the resulting encryption is the weaker of both the encryption and key derivation step.

If your password contains less than 128-bit strength (this is equivalent to about 21 characters passwords randomly chosen from a 64 character set, or about 9-words diceware passphrase), then yes your derived key will only have at most that many bit of strength, thus AES-256 will not improve on AES-128. But if you have a stronger password, then 256-bit AES can preserve more of the strength from the original password.

Mathematically, AES-256 is harder to crack than AES-128 when used with appropriate key derivation and password generation. Although in practice, 128-bit is already practically not brute forceable, so in practice using more than 128-bit passwords is overkill for most situations. The main purpose of 256-bit passwords and AES-256 is really just to increase the security margin of the scheme if it turns out that there is a cryptographic flaw that reduces the strength of the system.

Also, there are a lot of applications of AES where the key is not just derived from a password. For example, if the key is stored in a secure cryptoprocessor/smartcard, which can enforce lock down policy by forcing delays between attempts. There are also hybrid schemes where the system generates a 256-key that is then encrypted with a password, and the encrypted key is not stored together with the data, so that opening the encryption requires an out of band header.

Improve this answer
6
  • If you look at the OP's comment "I'm thinking about a 32 characters" to my answer it seems the OP is not using key derivation.
    – zaph
    Commented Sep 28, 2018 at 17:14
  • If key derivation is being used the brute force is against that, not the encryption and there is little difference in decryption speed between AES-128 and AES-256. Further when brute forcing encryption only a block or so need be decrypted in order to determine if the key is incorrect.
    – zaph
    Commented Sep 28, 2018 at 17:18
  • 1
    @zaph: it seems, like OP, you also are confusing key derivation and encryption. Also, there's no such thing as using a password and not using key derivation. A trivial binary decoding is still a key derivation function, even when there's no key stretching involved.
    – Lie Ryan
    Commented Sep 28, 2018 at 17:28
  • @zaph My main point is that AES-128 can only effectively use up to 128-bit passwords. Any higher strength passwords than that won't make AES-128 harder to crack. OTOH, AES-256 can use passwords that are more than 128-bit strong effectively, up to 256-bit passwords.
    – Lie Ryan
    Commented Sep 28, 2018 at 17:34
  • 1. I am not confusing key derivation and encryption. Key derivation is not to be confused with encodings, among other properties one is not reversible the other is. Just passing a pointer to an ASCII string is not key derivation. 2. In what existing scenario is a 128-bit key weaker than a 256-bit key given that neither can be brute forced.
    – zaph
    Commented Sep 28, 2018 at 18:14
1

AES-256 is currently no more secure than AES-128, given a random key neither is brute forcible.

If and/or when quantum computing becomes available AES-128 will no longer be sufficiently secure and AES-256 will remain secure.

If a password is being used that is the limiting factor. Using a secure key derivation method helps by imposing CPU utilization of ~100ms thus substantially reducing the success of brute force password attacks.

Improve this answer
6
  • 1
    What do you mean by 100 ms? Also, does using a long and enough random password (256 bits is 32 bytes so I'm thinking about a 32 characters one) grant about the same security as choosing a 256 bit random key?
    – Eärendil Baggins
    Commented Sep 28, 2018 at 14:47
  • 1
    1. Key derivation methods such as PBKDF2 have a rounds argument and current practice is to choose that such that the derivation consumes approximately 100 milliseconds of CPU time. Thus reducing brute force attempts by a factor of 10,000 times or more. 2. 32 random displayable ASCII characters has about 96^256 bits of security which is sufficient. But the catch is "random characters".
    – zaph
    Commented Sep 28, 2018 at 15:02
  • 1
    @EärendilBaggins You'll have to use the full range of bytes, not just ASCII printable characters, if you want to use the full strength of AES-256 with a 32-character password (to match a 256-bit key). If you're using 96 printable ascii characters, you'll actually need a 39 characters password (log(2**256)/log(96) = 38.87...)
    – Lie Ryan
    Commented Sep 28, 2018 at 17:42
  • On the other hand AES-128 can not be brute forced so for 128-bit security with random characters in a set of 96 20 characters will provide that. (log(2**128)/log(96) = 19.43)
    – zaph
    Commented Sep 28, 2018 at 18:09
  • @Lie Ryan Can I use a 39 characters password to generate a 256-bit key though?
    – Eärendil Baggins
    Commented Oct 9, 2018 at 19:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .