I was reading weaknesses in AES encryption. Unfortunately, I have a website that uses AES: Its database is almost entirely AES encrypted.
Is there a real threat? Would it be worth to refactor the web site's implementation?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Technically "cracked" only means that a method was found that reduces guessing from random guesses to slightly less than random guesses. The flaw that was discovered is one such minor crack. A perfect crypto-system would require making 2^127th guesses on average to crack a 128 bit key. The attack against AES allows it to be done on average in 2^125.1th guesses. Sure, it is over 1/4 faster, but 1/4 of now to the heat death of the universe is still far longer than we need to worry about.
And if you are truly worried, up the bit depth of your key and it's even more unlikely to be cracked. This is basically what the approach is for when 3DES is still used. There are significant compromises against DES, but upping the key length and using 3 DES operations back to back results in preserving a relatively secure algorithm out of something that has actual significant weaknesses to cryptanalysis.
The biclique attack only has a small advantage over brute-force cracking.
From Wikipedia, the free encyclopedia
Attacks have been published that are computationally faster than a full brute force attack, though none as of 2013 are computationally feasible: For AES-128, the key can be recovered with a computational complexity of 2^126.1 using the biclique attack. For biclique attacks on AES-192 and AES-256, the computational complexities of 2^189.7 and 2^254.4 respectively apply. [More...]
In other words, if your concerns regarding security are very high, you could upgrade to AES-256 (if you're not using this AES variety already).