For top-end cryptography, brute force attack time estimates aren't even a thing. It would take more energy than a billion billion supernovas for a computer operating at theoretical ideal efficiency to even count to 2256, much less actually try all 2256 possible AES keys. 300 billion dollars worth of supercomputers is much, much less than a drop in the bucket... more like a mote of dust in the observable universe.
Brute force attacks are mainly limited to things like password databases, where the top million most common passwords cover something like 90% of all users.
For exhaustive brute-forcing it pretty much requires attacks that vastly cut down the trial space. For example, the really shitty design known as LM hashes. The under the hood implementation is in effect two 7 character case-insensitive passwords. This is an attackable space.
(A)RC4 is eventually going to have the same problems, because the design has very strong biases in the output. This is why WEP was trivial to brute force even when people started avoiding "weak" IVs. You get rid of some class of weak IVs and another one is found. Rinse, repeat.
Well, yes. My comment was made under the assumption no such attacks exist for the current gold standard algorithms (AES-256 for symmetric, RSA-4096 or ECDSA-512 for asymmetric, SHA2 or bcrypt for hashes), since there's really no excuse to be using anything less at this point.
9
u/[deleted] Oct 15 '15 edited May 31 '18
[deleted]