Pay attention when public researchers say "if I had enough money, I think I could...", and you'll probably get a good sense of what the more advanced government agencies have access to.
As far as encryption goes, I'd say that AES-128 is probably safe from offline decryption by the NSA right now, but I wouldn't trust it to be secure ten years from now, or to be secure against active attack right now. I doubt the NSA can find pre-images for SHA256, but I wouldn't be surprised if they had found collisions. I doubt the NSA can factor 2048-bit semiprimes, but I'd be shocked if they couldn't factor 1024-bit semiprimes.
AES is approved by the NSA for top secret information. If they had found a way to crack it, don't you think there would have been a contest to replace AES like there was with DES?
AES is approved by the NSA for top secret information
Correction: AES192 and AES256 are approved by the NSA as a component in an approved implementation. AES128 is specifically NOT permitted for use with top secret information.
They're not that far ahead any more.
Schneier is probably right; the NSA is probably a few years ahead technologically instead of two decades ahead. However, they still have a very large budget.
Rijndael was selected in 2001 after a 5-year selection process. I assume AES128 was never allowed from the beginning; the alternative would leak too much information. We still think AES128 must be brute forced. So what's the chance that today they're over a decade ahead?
Comments
Pay attention when public researchers say "if I had enough money, I think I could...", and you'll probably get a good sense of what the more advanced government agencies have access to.
As far as encryption goes, I'd say that AES-128 is probably safe from offline decryption by the NSA right now, but I wouldn't trust it to be secure ten years from now, or to be secure against active attack right now. I doubt the NSA can find pre-images for SHA256, but I wouldn't be surprised if they had found collisions. I doubt the NSA can factor 2048-bit semiprimes, but I'd be shocked if they couldn't factor 1024-bit semiprimes.
http://en.wikipedia.org/wiki/Brute_force_attack
128 bit AES is rather out of anyone's reach
Correction: 128-bit AES is out of the reach of a brute force attack.
The NSA doesn't do brute force.
AES is approved by the NSA for top secret information. If they had found a way to crack it, don't you think there would have been a contest to replace AES like there was with DES?
They're not that far ahead any more.
http://www.schneier.com/essay-064.html
AES is approved by the NSA for top secret information
Correction: AES192 and AES256 are approved by the NSA as a component in an approved implementation. AES128 is specifically NOT permitted for use with top secret information.
They're not that far ahead any more.
Schneier is probably right; the NSA is probably a few years ahead technologically instead of two decades ahead. However, they still have a very large budget.
Rijndael was selected in 2001 after a 5-year selection process. I assume AES128 was never allowed from the beginning; the alternative would leak too much information. We still think AES128 must be brute forced. So what's the chance that today they're over a decade ahead?