Security level of modern encryption algorithms

crypto-bruteforce-estimates.md

Current estimates for bruteforcing modern encryption algorithms

Symmetric-key AES-256

• 2¹²⁸/2^62.117 (Bitcoin hashrate)=2^65.883 seconds
• 2.158 x 10¹² years
• 156.4 times the age of the universe

Assumptions

• Uses the current Bitcoin hashrate (2^62.117) as the fastest parallel computer currently available (using ASICs the fastest hardware currently available)*
• [Security Level] is typically equal to the key size of the cipher — equivalent to the complexity of a brute-force attack

Public-key

• "...attacks against current public-key systems are always faster than brute-force search of the key space. Their security level isn't set at design time, but represents a computational hardness assumption, which is adjusted to match the best currently known attack" [ref]
• The current RSA factorization record is for a 768-bit integer, announced in December 2009. It took four years and involved the smartest number theorists currently living on Earth. [ref]
• For the RSA cryptosystem at 128-bit security level, NIST and ENISA recommend using 3072-bit keys and IETF 3253 bits. Elliptic curve cryptography requires shorter keys, so the recommendations are 256-383 (NIST), 256 (ENISA) and 242 bits (IETF). [ref]