.onion addresses are just 80 bits, not 256. Someone estimated[1] that the amount of work to brute force one address is approximately the same as the amount of hashing that has been computed by the bitcoin network up to now, so it's clearly not physically impossible. This weakness is apparently a practical problem, because it made people unwilling to automatically issue SSL certificates for .onion addresses [2].

[1] https://news.ycombinator.com/item?id=11388997 [2] https://blog.cloudflare.com/the-trouble-with-tor/

The energy calculation assumes the computation is irreversible. If you use reversible computing, there is no lower bound: you can compute as much as you want for as little energy as you want.

The time calculation assumes our current computers and disregards Moore's law.

You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference. Your comment about current computers fails to grasp the scale that we are talking about here:

> It would take 10^38 Tianhe-2 Supercomputers running for the entirety of the existence of everything to exhaust half of the keyspace of a AES-256 key.

Let's assume that Moore's law is true for forever. In 300 years we will have a super computer capable of cracking a single AES-256 key in 37 millennium. However claiming that Moore's law will stay the same for 300 years when many think it won't last 30 is foolhardy.

>You have to create the algorithm to reverse an arbitrary AES-256 key, which is considered to be impossible, so that doesn't really make a difference.

What? Why is brute force impossible to code? I don't understand what you're claiming.

I agree that adding in Moore's law doesn't change the numbers by much. Moore's law plus weakening of cryptographic assumptions might do it, though. Plenty of previously-believed-to-be-strong crypto algorithms have been cracked, it's reasonable to think that we just don't have the tools to create unbreakable codes yet. (E.g. RSA is known to be breakable with quantum computers with Shor's algorithm.)

> What? Why is brute force impossible to code? I don't understand what you're claiming.

You claim that a reversible algorithm takes zero time. I said that requires a reversible algorithm that applies to an arbitrary AES-256 key which is currently thought to be impossible.

Brute forcing is not breaking but instead simply enumerating the key space and is subject to the slow downs we are talking about here.

> I agree that adding in Moore's law doesn't change the numbers by much. Moore's law plus weakening of cryptographic assumptions might do it, though. Plenty of previously-believed-to-be-strong crypto algorithms have been cracked, it's reasonable to think that we just don't have the tools to create unbreakable codes yet. (E.g. RSA is known to be breakable with quantum computers with Shor's algorithm.)

But you are missing the point of cryptographic systems, the goal typically isn't to be forever uncrackable, it is to be effectively forever uncrackable which includes upgrading the strength of your cryptography over time.

If we were talking about cracking crypto within 100 years then maybe we could talk about reasonable fear, but all of these things involve timelines that are longer than that (including quantum computer work).

>You claim that a reversible algorithm takes zero time.

No, you misread my comment. Reversible computing can take almost no energy.

Shores algorithm doesn't break anything. It just reduces the key space. Considering the major increase in energy costs and major lag in computational power of quantum computing, shores algorithm won't be a threat to today's crypto for hundreds of years to come.

It reduces key space for most symmetric algorithms, but completely breaks RSA and ECC making them run in polynomial time.