Problem - Kevin Tafuro

Triple-DES does. When it was the de facto standard, Triple-DES was considered adequate
for almost all applications.
In the real world, 128 bits of security may be enough for all time, even considering
that the ciphers we use today are probably nowhere near as good as they could be.
And if it ever becomes something to worry about, it will be news on geek web sites
like Slashdot. Basically, when the U.S. government went through the AES standardization
process, they were thinking ahead in asking for algorithms capable of supporting
192-bit and 256-bit keys, just in case future advances like quantum
computing somehow reduce the effective key strength of symmetric algorithms.
Until there’s a need for bigger keys, we recommend sticking with 128-bit keys when
using AES as there is no reason to take the efficiency hit when using AES. We say
this particularly because we don’t see anything on the horizon that is even a remote
threat.
However, this advice assumes you’re really getting 128 bits of effective strength. If
you refuse to use random data to prevent against collision and precomputation
attacks, it definitely makes sense to move to larger key sizes to obtain your desired
security margin.
See Also
Recipes 5.3, 7.3, 10.7, 11.1
5.4 Selecting a Cipher Mode
Problem
You need to use a low-level interface to encryption. You have chosen a block cipher
and need to select the mode in which to use that cipher.
Solution
There are various tradeoffs. For general-purpose use, we recommend CWC mode in
conjunction with AES, as we discuss in the following section. If you wish to do your
own message authentication, we recommend CTR mode, as long as you’re careful
with it.
Discussion
First, we should emphasize that you should use a low-level mode only if it is absolutely
necessary, because of the ease with which accidental security vulnerabilities
162 | Chapter 5: Symmetric Encryption
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.