Why 256 bit keys are large enough

Re:Why 256 bit keys are large enough by iwwr on Monday December 17, 2012 @01:20PM (#4933513)

For symmetric cryptosystems search difficulty is halved (a 256 bit AES key under a quantum bruteforce becomes as 'hard' as a 128 bit key under conventional bruteforce).

For asymmetric systems, search is reduced to polynomial (if using the discrete log, EC discrete log or prime factorization).

[ Parent | on HN ]

Re:Why 256 bit keys are large enough by jacquesm on Monday December 17, 2012 @07:19PM (#4935355)

Doesn't halving the search difficulty mean dropping 1 bit from the key length? So 256->255 rather than 256->128?

[ Parent | on HN ]

Re:Why 256 bit keys are large enough by scott_weber on Monday December 17, 2012 @11:07PM (#4936015)

The numbers are correct, but it was written in an odd way. Grovers algorithm gives a speedup of sqrt(n), so the exponent gets halved.

[ Parent | on HN ]

Re:Why 256 bit keys are large enough by betterunix on Monday December 17, 2012 @06:30PM (#4935140)

For some public key systems, the search becomes polynomial. Luckily, we know of ones for which that is not the case (as far as we know), and so if a practical quantum computer could be built we would just deploy new cryptosystems (pricey, but not end-of-the-world pricey).

[ Parent | on HN ]