If performance is of no concern, which TrueCrypt algorithm is the safest to use?
- Triple DES
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
these are the results of the voting in the final round of the AES-contest:
Rijndael 86-10 = 76 Serpent 59-7 = 52 Twofish 31-21 = 10 RC6 23-37 = -14 MARS 13-83 = -70
(http://csrc.nist.gov/archive/aes/round2/comments/20000523-msmid-2.pdf, linked via truecrypt serpent, read that one as well).
so, for a variety of reason Rijndael became AES, which is the successor of DES (and 3DES).
and, just because it popped up today on news.ycombinator.com, the story of AES:
Using TrueCrypt 7.0a, the most secure method of encryption is: Use the AES-Twofish-Serpent cascading encryption with the XTS method. Use the Whirlpool hash algorithm. (SHA-512 is a very close 2nd place here... it's debatable... I'm leaning towards Whirlpool because SHA-512 is already having a successor developed because of fears that it is based on an older SHA-1 that has been compromised.) MOST IMPORTANT is to use a VERY strong password. 20 to 30+ characters, uppercase, lowercase, numbers, symbols. Use Microsoft's online password checker for a strength test. You can also use Keyfiles to further secure your password.
I recommend the AES-Twofish-Serpent over the Serpent-Twofish-AES because you want the outermost encryption (AES will be the first layer they need to break) to be the most standard in the industry. That one is the most tried and true and the most tested of all of them. Plus, if someone assumes a file is encrypted with AES, there's no way of seeing that is is then encrypted with Twofish... so they do all this work to break the AES, only to find that Twofish stands in their way now. And then again after Twofish they run into Serpent, which is the biggest beast of them all (even though it is less used / tested than AES, it still has a much higher security margin than AES)
If you do use Keyfiles, I'd recommend having TrueCrypt create 3 keyfiles for you. Create one keyfile for each hash algorithm they provide. You might also add some .jpg's and some .mp3 files as well. I would make sure to make each keyfile read-only however.
This is probably overkill though.
The cascaded ciphers (AES-Twofish-Serpent, etc.) should be the most secure. Your data is encrypted with one algorithm, then the output from that is encrypted with the second algorithm, whose output is encrypted with the third algorithm. According to the TrueCrypt documentation, each algorithm uses a different key, each derived from your passphrase.
If a vulnerability is found in one (or two) of these ciphers, your data should still be secure, as an attacker would still not be able to break the remaining ciphers.
Rijndael won the AES competition primarily because it's the fastest and easiest to implement in hardware, not because it's the most "secure." Twofish and Serpent are usually considered more secure, but since they are all extremely rock-solid, that's a very subjective claim. And of course, encrypting with multiple algorithms will be even more "secure," but will reduce the speed even further.
Again, they're all rock-solid, so my advice would be to just go with whichever is fastest on your machine (usually AES).
Although there are some dangers in cascading multiple ciphers together, Truecrypt appears to deal with them as best it can. It doesn't add any known plaintexts to the output of the first cipher and it uses indepentant keys for each so by chaining the different algorithms together it should increase the security.
I would stear clear of 3DES though. Having read the Truecrypt page listing the choices of algorithm it doesn't even list triple DES so they may have recently removed it.
I've read that chaining algorithms together may result in weaker security due to the algorithm used to follow one with the other.
Further, the efficiency and speed will take a large hit if you used one of the combined ciphers.
I would recommend either Rijndael (AES) or Serpent and if you want it to be secure: the most crucial element is the key so make a very long key with at least one of each set of upper and lower case, number and symbol characters.
You can conceivably use a shorter pass word if you are using keyfiles, and if you are not worried about performance hits, using AES Twofish and Serpent will cause much headache to those trying to get into the encrypted material. But also don't overlook that you can also take one encrypted file and place it on the inside of a larger encrypted file. In this way, you can "allow" your attackers to look at the outside container and let them think they have the entire container. When in fact, they don't have anything at all. Feel free to put something slightly shady in the outside file, but nothing that would actually cause you problems. I think a slew of pornographic photos would fit this bill nicely, here is something that someone would want to hide, and as such, you have a nice reason. The outside container does not reveal that the inside container even exists. Place your actual material inside the inner container. Even better is to make the outside container "weak" with an insufficient password, and no keyfile. Let your attackers think they broke your encryption, and shrug your shoulders and say, "Damn, you are good, you have me dead to rights."
Best public cryptanalysis for each, assuming 256 bit variants (higher time complexity is better, but all kinds of caveats):
Undoubtedly, 3DES is the least secure, but that doesn't necessarily make it insecure (barring the usual unpublished backdoor concern). However I would avoid it. All of the other algorithms are generally considered secure. Determining the presence of an intentionally placed backdoor in any of them likely requires Snowden to release more documents. And honestly, if any of the top 3 did have a backdoor, that would be an absolute bombshell revelation. Given his track record, I'm personally happy to assume that they're still secure.
In 2001 the National Institute of Standards and Technology (NIST) launched the Advanced Encryption Standard (AES) and shortlisted five candidates (through multiple candidate conferences) with opposing algorithms to represent the standard. The Serpent cipher was one of them, garnering high security kudus, but eventually becoming a runner-up, to the Rijndael cipher. While this took place a few years ago it provides a fascinating glimpse into electronic data encryption and the trade-offs between performance and security. Interestingly, performance won!
In comparison with the other five candidates, Serpent cipher had the highest safety factor 3.56, which was quite good considering the fact that the next best one was Twofish cipher with a safety factor of 2.67. Rijndael-256 had a safety factor of 1.56
Since there are no known attacks against AES that make brute-forcing feasible (ref: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Known_attacks), unless you expect 3-letter agencies to devote their entire computing power for the next millennium to cracking your drive, AES is the way to go. The last version of TrueCrypt as well its forks support AES-NI, which on my Core i7 3770 provide a throughput of over 2.5 GB/sec.
Your connection to the IP address advertised by this domain uses AES encryption on most browsers (although CloudFlare holds the key seen by your browser, and decrypts and re-encrypts your data before sending it to the StackExchange servers, so don't use your TrueCrypt/VeraCrypt/CipherShed password for your StackExchange password because if said 3 letter agencies were to crack your drive, they'd intercept your password at the CloudFlare proxy and try that first long before attempting the never-going-to-work brute force).
I recommend that you use the Whirlpool hash with these algorithms as it is the strongest.
For encryption algorithms, you should use a cascade. I recommend AES, Twofish, Serpent. AES is quite weak (compared to other algorithms but is the fastest) and is the industry standard therefore will be effective as an outer layer. Twofish is even stronger and after decrypting the AES layer, there will be another layer (Twofish) which is even stronger. Serpent is the strongest and this cascade proves effective.
Some extra info: For passwords, the NSA has a quantum computer that can decrypt very quickly. I would not trust the NSA (they designed AES). I would recommend a minimum of 40 letters, lowercase and uppercase, numbers, symbols and no dictionary words or personal information (birth dates etc.) and you could use keyfiles. If you are at risk from an adversary, use the plausible deniability features built into TrueCrypt.
Rijndael (Currently THE AES) is the best algorithm.
First, it's not said that AES is unbreakable, merely that none of the currently known attacks reduce the computational cost to a point where it's feasible. The current best attack on AES-128 takes 2^126.1 operations, if we had a computer (or cluster) several million times more efficient than any current computer and could operate at the thermodynamic Landauer limit, it would take 234 petajoules just to increment a counter through every key value. That's about half of the annual electricity consumption of Norway. Actually computing an AES round takes several times that much energy.
Twofish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits. It was one of the five finalists of the Advanced Encryption Standard contest, but it was not selected for standardization. Twofish is related to the earlier block cipher Blowfish.
Twofish's distinctive features are the use of pre-computed key-dependent S-boxes, and a relatively complex key schedule. One half of an n-bit key is used as the actual encryption key and the other half of the n-bit key is used to modify the encryption algorithm (key-dependent S-boxes). Twofish borrows some elements from other designs; for example, the pseudo-Hadamard transform (PHT) from the SAFER family of ciphers. Twofish has a Feistel structure like DES. Twofish also employs a Maximum Distance Separable matrix.
On most software platforms Twofish was slightly slower than Rijndael (the chosen algorithm for Advanced Encryption Standard) for 128-bit keys, but it is somewhat faster for 256-bit keys.
Serpent is a symmetric key block cipher that was a finalist in the Advanced Encryption Standard (AES) contest, where it was ranked second to Rijndael. Serpent was designed by Ross Anderson, Eli Biham, and Lars Knudsen.
Like other AES submissions, Serpent has a block size of 128 bits and supports a key size of 128, 192 or 256 bits. The cipher is a 32-round substitution-permutation network operating on a block of four 32-bit words. Each round applies one of eight 4-bit to 4-bit S-boxes 32 times in parallel. Serpent was designed so that all operations can be executed in parallel, using 32 bit slices. This maximizes parallelism, but also allows use of the extensive cryptanalysis work performed on DES.
Serpent took a conservative approach to security, opting for a large security margin: the designers deemed 16 rounds to be sufficient against known types of attack, but specified 32 rounds as insurance against future discoveries in cryptanalysis. The official NIST report on AES competition classified Serpent as having a high security margin along with MARS and Twofish, in contrast to the adequate security margin of RC6 and Rijndael (currently AES). In final voting, Serpent had the least number of negative votes among the finalists, but scored second place overall because Rijndael had substantially more positive votes, the deciding factor being that Rijndael allowed for a far more efficient software implementation.
SHA is alot better than MDA, Whirpool, etc. But they found a way to break SHA. There it comes SHA-2 (HMAC). Again they found a way to break it. There it comes SHA-3 (Kakee or something like this). But in TrueCrypt, VeraCrypt, CipherShed or TrueCryptNext do not exist SHA-3.---------------------------Source: Any place in my memory ;-)
After a quick search I'd say
AES 256 bits.
I would avoid Triple AES and Triple blowfish. Running the same algorithm multiple times may result in less security then using the original algorithm one time.