From StackOverflow [0]:

"We can't implement "AES 512 key size" because AES is defined for key sizes k∈{128,192,256} bits only; much like we can't make a bicycle with 3 wheels."

[0] http://crypto.stackexchange.com/questions/20253/why-we-cant-...

I was about to disagree with the bicycle analogy, and realized that a tricycle is indeed different than a bicycle, at least by name & definition. Clever analogy.

I love my recumbent tricycle. Legally it’s a bicycle; the fact that it happens to have three wheels is irrelevant.

Not to mention that 128bits is secure enough for the foreseeable future

There's no such thing as "end to end" encryption for webmail, unless you have a browser extension that can validate the JavaScript you were served from the host (which is capable of performing the decryption and obviously has access to your private key).

Otherwise you're just trusting that you've not been served backdoored JS by order of an NSL.

Browser extension would be useful either because it's usually autoupdated and unsigned.

Plus trusting the extension, the browser, the OS and the HW.

You lost me at AES512...

If you think AES512 isn't secure enough for your data you should not be hosting your mail server out of your network.....

Also, if you have a way to break AES512 I know some people who'd pay a killing to get that information. No litterally there's people who'd kill for that.

AES512 isn't a thing. AES uses 128, 192 or 256-bit keys.

Since there is no such thing as AES512, 'breaking' it isn't that hard...

Fine, AES1024 then! Pedants.

AES512? Is there some 512-bit symmetric key cipher?

They could encrypt with two(or more) 256bits keys, but I think just 256bits key is enough for at least next 5years.

RC4 accepted up to 2048 key bits. (It is symmetric, it's just not a block cipher).

I think ideally you don't what a set reveal date for all of your personal emails. 5 years is very short term to wait for some good email data.

A brute-force attack on AES256 would currently take (10 * 2^256) / (4 * 10^9) seconds, assuming a 4Ghz CPU with 10 clock cycles per try. As long as my calculator tells me it takes "NAN" years to crack my encryption I'm not getting nervous. Quantum computing may change that, but it's currently in the weird space between ("all bets are off, anyway" and "it's not magic").

On top of that, I don't remember the specific assumptions but my Crypto professor proved that just to increment a counter to 2^256 would take more energy than exists in the observable universe.

I think also everyone is pretty sure quantum computing won't break AES, but maybe there's some weakness in the S/P boxes that quantum computers can exploit, who knows. That's the fun in crypto, you can't prove that anything other than OTP is unbreakable.

> On top of that, I don't remember the specific assumptions but my Crypto professor proved that just to increment a counter to 2^256 would take more energy than exists in the observable universe.

Well, depending on the theory the universe isn't even supposed to have any net sum, but regardless: even at the Landauer limit (at room temperature; it scales linearly to absolute temp) it would take an awful lot of energy to do the computation non-reversibly, about:

    2**256 * 256 * 2.5 zJ
    ~ 8e+58 J

Which is about 38 orders of magnitude greater than the total energy use of the world (~3.75e+11 GWs).

And any computer built so far is still far, far away from the Landauer limit.

There is also Bremermann's limit which is an intrinsic limit on the processing speed per mass. Eg. a machine that traverses a 256 bit key space in 15 years with one one bit operation per traversed key must weight at least ~1.8e+21 grams, which would be quite a chunk of machinery.

This just goes to show that brute-forcing 256 bits is simply not going to happen with any civilization that isn't able to harness the power of at least one star.

That doesn't say anything about cryptanalysis, though. I think with an algorithm like AES, which has been analysed a great many times, that it's becoming less likely that there is a cryptanalytic breakthrough. It might be the case that AES will remain secure throughout the information age.

> On top of that, I don't remember the specific assumptions but my Crypto professor proved that just to increment a counter to 2^256 would take more energy than exists in the observable universe.

This proof is present in Schneier's "Applied Cryptography" if someone wants source.

Quantum computing is not going to change that, but it can break key exchange.