> For the complete documentation index, see [llms.txt](https://docs.aeterna.works/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aeterna.works/encryption.md).

# Encryption

About security assumptions

Aeterna is using a number of standardized algorithms for encryption, such as:​

* ​Keccak256 for hashing (pre-NIST-approved version)
* ​MLKEM — Kyber-1024 with SHAKE-128 inside, with AES-256 for post-qunatum encryption
* ​Argon2 for key derivation from passwords
* ​ECDSA for signatures (with Keccak256 inside)

​All these algorithms are widely known and battle-tested.​

**The resistance against quantum computers**

​The minimal requirement by today's science is to have at least 2<sup>256</sup>-bit security for quantum-computer threat. Currently there are 3 algorithms that people care about:​

* ​Shor's algorithm — solves integer factorization and discrete logarithmic problems via finding the Hidden Subgroup Period by utilizing Quantum Furier Transform (QFT).
* ​Grover's algorithm — provides quadratic speed-up for the unstructured search, so 2<sup>128</sup>-bit security becomes 2<sup>64</sup>-bit. Therefore 2<sup>256</sup>-bit security is required to have a minimal 2<sup>128</sup>-bit security after Grover's algo becomes effective enough.
* ​Brassard-Hoyer-Tapp (BHT) algorithm its improvement Chailloux-Naya-Plasencia-Schrottenloher (CNS) — provides a worst-case scenario of cubic speed-up in quantum collision search against hashing algorithms specifically. So 2<sup>256</sup>-bit security becomes 2<sup>85</sup>-bit quantum security. Based on Birthday Paradox and Grover's algorithm. Therefore it is required for hashing algorithms to have at least 2<sup>384</sup>-bit security to arrive at 2<sup>128</sup> after BHT is applied. This is considered highly theoretical and likely the van Oorschot-Wiener (vOW) algorithm is the better solution which is founded on Pollard's Rho algorithm on classical computers in parallel.

​Now, the security of the used protocols can be described the the following:​To pick up a draggable item, press the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in its new position, or press escape to cancel.

| AlgorithmAlgorithm | Security assumptionSecurity assumption                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Keccak256          | Hashing algo - is not related to the encryption of data.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| MLKEM (Kyber-1024) | Provides a classical 2<sup>254</sup> and 2<sup>230</sup> quantum (Grover) security underBlock-Korkine-Zolotorev (BKZ) lattice basis reduction algorithm. Is not affected by Shor's algorithm since the math here includes noise.However, in the beginning it generates the random seed of 32 bytes, that then splitted and extended via SHAKE-128. So in some sense the security here is as strong as in AES-256, which is the minimal 2<sup>128</sup>-bit                                                                                                                                                                                                                                                                                                                                            |
| Argon2id           | <p>The params used like in RFC 9106:​</p><ul><li>​64 MegaByte memory</li><li>​3 iterations</li><li>​4 parallelism</li><li>​32-byte output</li><li>​12 characters minimal length</li></ul><p>Security here is measured differently:Breaking it with quantum computers is extremely difficult because of hardware bottlenecks (needs billions of qubits), but easier in classical sense with botnets, that is why a minimum of 16 characters is asked which yields at least 2<sup>104</sup>-bit security coming from password entropy alone, the hardness comes from huge costs coming along to just be able to try breaking it.Generally speaking, the security of passwords in this case is entirely shifted on the length and readibility of the password, and on the efficiency of the botnets.</p> |
| ECDSA              | Vulnerable to quantum computers with a caveat that it does not help to prove or disprove the authenticity of a signature, there only makes sense to switch after quantum computer is invented.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |

To pick up a draggable item, press the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in its new position, or press escape to cancel.