Summary: KEYBOX is unaffected by recent research findings against the AES-128 encryption algorithm.
It was reported a couple of days ago (17th of August 2011) that researchers found the first weakness in the AES-128 algorithm. This weakness is said to reduce the amount of time required to brute-force attack an encrypted secret by a factor of 4. This means that a secret could be hacked in 1/4 the time it would normally take had this approach not been discovered.
As any visitor to my website is well aware AES-256 is the cryptography algorithm used in KEYBOX. I would like to take this time to spell out what all this means for all KEYBOX users.
How this impacts KEYBOX?
It doesn’t. At all.
The research is applicable only to AES-128, a much weaker variant of the AES-256 algorithm. The article explains that AES-128 becomes AES-126 as a result of this exploit. That is to say that the effort required to encrypt secrets is 4 times less but still so high as to be impractical.
The key quote which spells out how much effort is now required to discover a secret’s contents via brute-force:
To put this into perspective: on a trillion machines, that each could test a billion keys per second, it would take more than two billion years to recover an AES-128 key.
AES-128 is still regarded as a strong algorithm, even after this discovery. Furthermore, KEYBOX uses the much stronger AES-256. The number of computation rounds used here is considerably higher than that of AES-128 and it’s strength is equally higher. You and I will be long passed away before our secrets could be broken into.
Conclusion:
The sky is not falling. There is no change needed in how KEYBOX should operate as such attack vectors were well considered during its design and development.
If you have any questions or concerns please contact me at jay@jayfuerstenberg.com.
