One Encryption Standard to Rule Them All! - Computerphile

[@GrandMoffTarkinsTeaDispenser]

This man is always dressed the same way his consistency is fascinating.

[@fountaingoat6802]

He is computer generated

[@alexandreperalta472]

He's the upgrade version of Max Headroom

[@MarcAlexandrePaquette]

He's run on the same program as Tom Scott

[@seangad8227]

You have no power here!!!!

[@olamarvin]

Unless a better clothing algorithm is found, there's no need to use anything else.

[@JeanRomainRoy]

The man, the myth, the legend Dr Mike Pound

[@Saturate0806]

*Dr Mike Pwnd

[@lawrencedoliveiro9104]

In his honour, instead of #hashtags in future, let us have £poundtags.

[@INeedAttentionEXE]

I’m Sam pound, I’m number one, apologizing for what I’ve gone, if you’re wondering what that was I snuck into a bathroom and *beeeeeeeeeep*

[@HEbr-rg2jz]

@@lawrencedoliveiro9104 £We_should_do_that

[@sebastianelytron8450]

This guy carries this channel, probably single-handedly responsible for half a million subs

[@3dlabs99]

He is very motivating -- I always feel like doing what he talks about as my next project :)

[@casperes0912]

Sebastian Elytron Brailsford.

[@misterhat5823]

Hah. You can't be forgetting Professor Brailsford. I'm sure he's also responsible for a lot of subs.

[@arik_dev]

Him and Brailsford are the most compelling speakers, who also have many very interesting things to talk about. However, as an avid comp sci geek, you'd be hard pressed to find a video on this channel that I wouldn't want to watch.

[@misterhat5823]

@@arik_dev I've found a few that didn't interest me, but they are few and far between.

[@soyitiel]

now I'm really looking foreward to that *_other video_* where we're gonna talk about all those other topics we couldn't in this one

[@yodings]

Im always looking forward to the topics that they wont go into in the current video..

[@TheBrahmadath]

Happens to me all the time

[@michalbotor]

yes! enough chitchat! to the maths!! ;-)

[@jayextarys8616]

I had to screenshot that comment. That's beautiful.

[@Shadow81989]

"We'll talk about this in another video." "Oh, and we'll talk about THAT in another video." "...and that!" Really looking forward to all these videos with one of the greatest guys on Computerphile (and there's some strong competition going on, make no mistake on that!).

[@gauntletwielder6306]

I have been fascinated with the complexity of encryption algorithms since I was a teenager decades ago. I was fortunate enough to get my hands on the original IBM publication that documented their DES. ( As proof, the only two inks used, were black and purple ) That documentation was incomplete. I managed to fill in the gaps and implement the DES in 6502 assembly language. It took 45 seconds to encrypt/decrypt 2048 bytes on a 1Mhz machine. I verified my implementation using the test data and expected results listed in the documentation. One of the main problems with DES, was that no one trusted it. The design goals/requirements were not made public. People felt it had questionable/nefarious origins. Along comes AES. Definitely faster than DES.

[@_PsychoFish_]

Other KZbin Video: "hmm almost 10 minutes, I'll watch that later..." *sees Dr. Mike Pond*: "damn, this is not even 10 minutes..."

[@edward3812]

^ Dr. Michael Pound

[@MahmudulHoque-yr5xg]

This person is solely responsible for reigniting my interest in academic research. Hope he makes more videos.

[@lawrencedoliveiro9104]

1:33 Two keys, not three for triple DES. That’s what it says in Tanenbaum’s _Computer Networks_ text, 4th ed, page 740. You encrypt with key K₁, decrypt(!) with K₂, then encrypt again with K₁.

[@Keneo1]

Lawrence D’Oliveiro yep, this keeps it backwards compatible with normal DES if you choose the same key for k1 and k2

[@joeyhensley9199]

@L. Kärkkäinen 3DES was broken by MIT students using parallel computing in a few weeks. If I remember correctly.

[@joeyhensley9199]

@L. Kärkkäinen AES is far superior to 3DES, aka TDES. But two fish is more secure than AES. AES IS faster and more... efficient, though.

[@enochliu8316]

Triple DES could be keyed either with two keys (encrypt with K1, decrypt with K2,encrypt with K1 again) or three keys (encrypt with K1, decrypt with K2, encrypt with K3).

[@m41kdevelops41]

If only professors were all just like this man.. our lives would be so much easier...

[@landrover4444]

Dr. Mike Pound's explanations are the clearest and easiest to understand for the layperson that I have ever heard. Please do more videos with him.

[@forthrightgambitia1032]

It would be nice if Blowfish/Twofish was covered. There has been some controversy about its not being selected given its performance on 256bit keys.

[@among-us-99999]

Smh, I use double ROT13 encryption on all my files.

[@KEL5isGodrules]

hol up-

[@n8style]

haha :D

[@stromboli183]

Same here. Although it may not be the most secure (quantum computers could probably break it), it’s extremely efficient 👍

[@among-us-99999]

@Stromboli I’m a master hacker. I can crack double-ROT13 encryption in my head.

[@insanemal]

I'd like this but its sitting at 69 likes... Nice

[@Pandovian]

My professor of Linear Algebra was Vincent Rijmen, the guy behind Rijndael, we never knew what he crrated, just that is was worldchanging

[@陳秉軒-c9b]

I see Dr. Pound, I watch the video.

[@mattjclay]

Would you say you Pounded the play button?

[@mattjclay]

@@PhoenixTubez not saying I didn't too. 🤣

[@lemonposting]

Dr. #

[@Skindoggiedog]

NPC.

[@mishasawangwan6652]

this guy is the best computerphile explainer-dude ..don’t matter what he’s talkin’ bout.. it’s just good talk.

[@MachtFisch]

I am always happy to see a video with Dr. Pound in my subscription feed :) keep up the great work!

[@lukor-tech]

Always here to watch one of the only channels on YT that are worth it.

[@azkamil]

you mean that famous "military grade encryption" :)))))))))))

[@4.0.4]

You can trust NerdVPN, where we drink military-grade coffee.

[@dakoderii4221]

@@4.0.4 If anyone doesn't know what "military grade coffee" taste like, just pour some muddy water and turpentine together and add lots of sugar. Delicious!

[@OmarChida]

We all love Dr. Mike Pound

[@esmatsaidy]

This man is genius!!! I like the way he explains cryptography and complex things.

[@litebooks7638]

I could listen to him talk all day!

[@batmanthebat5052]

AES 2: Electric Boogaloo

[@garybuttherissilent5896]

Joan Daemen is my professor at Radboud University, so awesome to be taught by one of the best :D

[@linuxguy1199]

"One Encryption Standard to Rule Them All!" - Famous last words

[@kebman]

He did mention ChaCha20 tho.

[@vitalydoletsky6030]

7:11 Q: Is that job done then? A:

[@timothycurnock9162]

The true code is the QUANTUM KEY CODE, it is your personal security key that only you will recognize when you get it. A quantum key is truly unbreakable any attempt to hack the key results in the destruction of the key. When you have the key you are working with very advanced computers so it is best to abide with the guidelines as best possible. Quantum key codes are sent via the smallest possible particle along a fibre optic line at a specific predetermined time. If the line is broken, the key gets destroyed because it is the most fragile thing. If the key is not received then the user knows that there was an attempt to hack the key. You can never know me, I hope you also get your key. You will know what it is.

[@Zlysium]

@@timothycurnock9162 Are you possibly _VERY_ high right now? Like high enough to need to seek medical help?

[@lawrencedoliveiro9104]

@@timothycurnock9162 How does the key know the difference between a “hack” and a “legitimate decrypt”?

[@timothycurnock9162]

@@lawrencedoliveiro9104 the key is given only to 1 specific target. That target will know it is the quantum key, it will be as plain as day.

[@lawrencedoliveiro9104]

@@timothycurnock9162 How does the key know who it has been given to?

[@karolbomba6704]

interesting video, thank you for sharing these for free!

[@pognar]

The fact that Mike Pound doesn't have a youtube channel is a crime. Great video though

[@sephirothbahamut245]

I need another video like the timezones and colalization ones… I love how they give me anxiety by just watching them.

[@TheTwick]

So, what about the next step - triple rijandael?

[@DFX2KX]

(For those that don't know, triple-ecryption goes like this: Cypher == encrypt(key1,(decrypt(key2,(encrypt(key3,(plaintext)))), plaintext = decrypt(key2,(encrypt(key2,(decrypt(key1,(Cypher)))). It uses the same hardware, takes 3 times longer, and is not quite 3 orders of magnitude more secure) I actually did that with AES in Python for a Corsera class, just for the lulz. Not taking the fact all three keys need to be in RAM, and other various implementation problems (you don't attack the encryption, you attack it's implementation), trying to bruteforce that would be laughably hard.

[@JNCressey]

I wonder if triple-ROT13 is 3 times as secure as ROT13. 😏

[@Yotanido]

@@JNCressey Better go for quadruple, just to be sure.

[@mintsauce82]

Few things cheer me up like a new Mike Pound video

[@NocturnalJin]

I'd love to see you cover ChaCha20. It's especially great for PRNG. Also, Galois Counter Mode (GCM) is really cool and worth covering (IMO).

[@timlarkin4471]

8:15 "Jar Jar 20" An algorithm written in Gunganese. Unbreakable except when spilling water on the device.

[@Keneo1]

Tim Larkin chacha20

[@kebman]

@@Keneo1 No, JarJar20 is a new algo. It's from a galaxy far, far away.

[@cmilter6360]

This guy has passion, I wish he was one of my teachers

[@DantevanGemert]

Imagine having the co-designer of Rijndael as your teacher (That man is an absolute legend)

[@merlijniboy]

@@DantevanGemert Rijmen = best linear algebra teacher.

[@vishalmishra3046]

Speed and security considerations - ChaCha20-Poly1305 is faster in software than AES-GCM. AES-GCM will be faster than ChaCha20-Poly1305 with AES-NI. AES-CTR with HMAC will be faster in software than AES-GCM. Poly1305 is also easier than GCM for library designers to implement safely.

[@joeyhensley9199]

In physics, a chain is only as strong as its weakest link. However, in cryptography, the inverse is true. The message is as secure as the strongest method used. Yes, I am talking about "daisy chaining" crypto systems. 1. ROT 13 2. AES. You can't get to the super simple ROT 13 unless you first break AES..

[@BaronSamedi1959]

A Belgian is at the root of the world wide web; two Belgians have invented the present secure data algorithm. Wow, we are such a plucky little country!

[@chrisb4009]

Who are you referring to?

[@puntypunty8847]

@Chris B Rijmen and Daelen are professors at the University of Leuven and they made rijndael @Karl Moens if rijndael did'nt exist serpent would just have been chosen

[@chrisb4009]

punty punty also, encryption isn’t the route of the internet. Much of what we do online isn’t encrypted.

[@supersloth1667]

I'm a simple man, I see Dr Mike, I click.

[@laharl2k]

Coincidentally TrueCrypt uses the three of AES, Serpent and Twofish chained together to encript its data

[@trissylegs]

Chacha20's design wasn't just to make it faster in software using conventional hardware. It also designed to avoid side channels in software implementations. Due to fast implementations of AES needing lookup tables the key can be inferred due to timing differences. (Also the sound the CPU makes which is freaky) Chacha20 is also seekable, if you have encrypted a 20GB block and you want to read the end of it. In AES-GCM you'd decypt the whole block. In ChaCha you can decrypt any part of the sequence. (Also XChaCha20 is now used in TLS 1.3)

[@enochliu8316]

AES-GCM actually works similar to ChaCha-20. You give it an counter value to use and it spits out a keystream to use. AES-GCM is therefore seekable as well, as you can decrypt only the end of the block.

[@tuanbe]

You bring the story a bit like ‘Drunk History’. Love your style!

[@dropcake]

Love these videos Dr. Pound. Currently I'm learning about AES in my graduate Cryptography class and your video make is easy to understand the concept. Keep up the good work and hope to see you often! Thanks!

[@chrisjonesowns]

I'm waiting for a Dr. Pound video about quantum computers and the future of encryption.

[@robbydomino]

At 1:30 he is saying that triple des uses 3 keys. Triple des uses a encryption(key1) decryption(key2) encryption(key1) pattern so it uses 2 keys. It also has the weakness in the case that the 2 keys are equal because it then decrypts the encryption with the same key so that part cancels out. making triple des equal to des in that case.

[@tomschmidt381]

I vaguely remember this back in 1990's. Once the US eliminated the restriction on encryption key length and the internet become more popular there was dire need of a new encryption standard. As stated this was driven in the US by NIST so there was some concern the selection process was weighted in favor of the NSA - to allow them to more easily break the cipher. Given AES is an open standard that does not appear to be the case. It certainly has become pervasive.

[@laurendoe168]

How would quantum computing effect the security of AES?

[@raphaelqueiroz7925]

I think it's been proven that quantum computers won't ever be able to break a N bit key with less 2^(N/2) operations. Doubling the key length would do the trick as a first step, but keep in mind that we are very far from entangling enough qbits and even further from achieving sufficiently low error rates.

[@funnyids3D]

AES has been proven to be quantum resistant when using more bits for the key

[@Dsiefus]

It reduces the complexity by "half", that is as if the key was half the length. When using a 256 bits key, then as he said in the video even a 128bit key is hard enough.

[@laurendoe168]

@@raphaelqueiroz7925 Thank you for the reply. I had heard quantum computers could tackle some jobs that were for all intents and purposes unsolvable in under a billion years on today's digital computers. I was wondering if this was one of them.

[@raphaelqueiroz7925]

​@@laurendoe168 You're welcome, I also forgot to mention that what I said is only valid for symmetric ciphers like AES. There are some asymmetric ciphers that will become unusable if they are based on integer factorization, but even then we are far from having strong enough quantum computers, plus there are alternative asymmetric ciphers that aren't based on integer factoring ! So yeah, quantum computers are very cool, they will break RSA one day, but that's pretty much it, at least concerning cryptanalysis.

[@slr150]

0:20 That depends on the cipher suite negotiated during the TLS handshake.

[@DynoosHD]

looking forward for the AES video

[@4.0.4]

This and Miles (the AI guy) are my favorites.

[@Athenas_Realm_System]

I hope a video is done on the current Post-Quantum Cryptography Standards competition.

[@stefanbogdanovic590]

This guy deserves a statue one and only Dr. Mike Pound!!!

[@_skeptik]

I hope one day we will see a video about DES

[@XzcutioneR2]

Dr. Pound looks like an older normal-weight version of Jared Dunn from Silicon Valley

[@notaprogrammer7970]

Normal weight version, love the PC.

[@vishalmishra3046]

In addition to security and performance, NIST has to deal with political pressure from NSA (make it strong enough, so that the community adopts the standard, but not strong enough, so that NSA cannot break it, for national security reasons). Former led to the selection of Rijndael and the latter led to the elimination of 256-bit state (only 128 bits allowed even when key-length is 256 bits). This was not public knowledge until the latter over-shadowed former, with standardization of Dual_EC_DRBG. AES is great for pretty much everyone but for the super-paranoid, use Rijndael with 256-bit block size or preferably switch to using CHACHA20 (256 bit key with 512 bit state). The new TLS 1.3 standard requires CHACHA20 as a mandatory algorithm to support strong encryption. The crypto industry has learnt a lot since 2001 (when AES was standardized).

[@_adi_dev_]

Can we look at post quantum encryption standards please

[@puntypunty8847]

My dad is a journalist and he interwiewed Rijmen en Daelen and they said that they made the name do that english speaking people would'nt be able to pronounce it and ...

[@sstorholm]

Please do a video on CHACHA20, since it's one out of the three "standard" TLSv1.3 ciphers.

[@OleTange]

And please make it a video where you compare the algorithm to Rijndael.

[@hassansyed5661]

AES is my favourite encryption. Make video about DES encryption too.

[@brandon26]

Im a simple man, I see mike pound, I click the video

[@Keksmania]

You changed the title! I noticed it

[@dannyism3221]

Beautiful. Two members of the cryptographic community get together and create an algorithm that bests the efforts of tech giants like IBM.

[@NoNameAtAll2]

now waiting for "how rijendael works"

[@MrRand0mMe]

New stuff is ChaCha20/Poly1305 and Ed25519 - not susceptible to side channel attacks and shorter assymetric keys.

[@cacheman]

AES specifically called for block ciphers. ChaCha20 is a stream cipher. So yes, it's newer, but it's not the same class of algorithm and has different design goals.

[@sujan740]

My precious

[@venil82]

I thought he was talking about Ryan Dahl, the nodejs inventor

[@gladzcreations8649]

He is busy with Deno.land

[@Rhys_Beer]

always enjoy these videos thanks

[@EulerJr_]

Can someone explain to me what Mike refers to at 07:46? Thanks.

[@y__h]

"DES was made by IBM, with the help of NSA" Oh do you mean when NSA tried to shorten DES key length to 48 bits while IBM tried to stand still on 64 bits, with the spice to the story that some guy brawling over like a child in between?

[@notaprogrammer7970]

Ooh do please elaborate on the drama.

[@Acorn_Anomaly]

I don't recall that, though I would like to know more. I DO recall the NSA secretly _strengthening_ DES, not weakening it, by suggesting a new set of S-boxes to use. They never said why at the time(which obviously made people think they weakened it), but research into it years later realized that the NSA's changes made the algorithm more resistant to a special type of attack that wasn't even publicly known at the time DES was first standardized, meaning the NSA knew the technique all along, and buffed up DES against it.

[@tryptex]

RCS is becoming more and more common, thoughts on talking about it at some point?

[@morkovija]

Great stuff!

[@megumin2332]

I used slowloris from an older video to stop the site where i have the homework for info :)) thx computerphile

[@lmaoroflcopter]

Well done. You just skidded and then admitted/boasted of it on a KZbin channel. You're gonna go far kid.

[@fribiesdi]

I like this channel, I will subscribe immediately.

[@DoctorShaunB]

I can't believe how similar his facial expressions are to Brad from Bon Appetit!

[@metryannm1936]

well this is a crossover i didn't expact! mind elaborating on the similarities?

[@bernardusmuller1109]

I always think we're probably never gonna see the videos they say they'll talk in some other video.

[@darkseid6412]

RINJDAEL IS BOTH OF THEIR NAMES!!!

[@itchykami]

So for 'something would have to go really wrong for us to reinvent the wheel', what about the sycamore chip?

[@PriyanshulGovil]

..., one encryption to find them. one encryption to bring them all, and in the darkness bind them.

[@passingthetorch5831]

Video on quantum resistant public key cryptography methods like lattice based methods?

[@frosecold]

I took my Sec+ today, I got it!

[@EpicVideoMaster11]

Thank you

[@karmasyke]

"One of the nice things about academia is that if you perform good work people will notice that work" yeeahhh about that...

[@pachualt]

When he says "sp networks", all I hear is "yes peanut works". I might just be hungry.

[@bernardinojosa3777]

i thought that he was going to talk about "ryan dahl", the creator of node.js

[@jaspersurmont4803]

Vincent Rijmen is my prof at my university :D

[@theharbingerofconflation]

Twofish should have one, just as blowfish before it. But we’re talking NIST here. Can’t play a game you cannot win yourself.

[@TmOnlineMapper]

Current consent between security researches is that Twofish is the best among the initial submissions and should have won. In any case Rijndael won and that algorithm still isn't bad.

[@DFX2KX]

@@TmOnlineMapper as far as modern hardware goes, IIRC all five initial submissions have hardware support these days, I know Twofish does.

[@hanelyp1]

I don't know of any particular weakness to AES, but I still like blowfish / twofish. As for speed and hardware implementation, blowfish was designed for efficient implementation with an integer instruction set on then common 32bit processors. And shouldn't be too bad for speed even on an 8bit processor.

[@jamestanis3274]

To be fair: DES can be computed blazingly fast in *hardware* which is what was important at the time (1970s) when it was developed. Unfortunately all the bit-operations made it dog-slow in software.

[@stromboli183]

Suggestion: could you do a video on elliptic curve cryptography, i.e. public/private key cryptography based on elliptic curves? (such as ECDSA which is used in Bitcoin) Older public key cryptography such as RSA (based on large prime numbers) is explained in depth in many videos, and is relatively simple. But I haven’t seen anyone ever properly explaining ECC.

[@Jirayu.Kaewprateep]

Correct famous algorithms suitable but they aren't limits by input parameters but change it often that create in security by process too. 😃

[@krisr3868]

I'd like to see a video on the CAESAR crypto competition one day. And the SHA-3 process as well. AFAIR (from classes taught by the man himself, though it's a handful of years ago), Lars Knudsen (from the Serpent team) agrees with the choice of Rijndael as AES. Not so much with Keccak as SHA-3.

[@wildexploit]

One encryption standard to fail us all. When a vulnerability is found.

[@joshuabeha4434]

Is the ring in the thumbnail a reference to digital fortress?

[@TheBrahmadath]

At 0:03 , thought he was talking about NodeJs creator, Ryan Dahl.. 😜

[@pow9606]

Thought they was talking about the geyser that wrote Charlie and the Chocolate factory. 😆

[@z3my4l]

Well done pronouncing ”Nokia”!

[@FabianCook]

Why wasn't NIST mentioned along with post-quantum?

[@OleTange]

"It will take millions of years to break" That is only if you assume that you buy the hardware today. And thus this is a very wrong assumption. 2^128 is a large number: 3 * 10^38. Assume you can test 1 G keys per second today, and hardware gets 2x faster every 10 years. That is a fairly modest assumption today. In the first 10 years you will have tested 10^9 keys/s * 3*10^7 s/year * 10 year = 3*10^17 keys. In the next 10 years you will have tested 2^1 *10^9 keys/s * 3*10^7 s/year * 10 year = 6*10^17 keys. In the next 10 years you will have tested 2^2 *10^9 keys/s * 3*10^7 s/year * 10 year = 12*10^17 keys. ... In year 300-309 you will test 2^30 *10^9 keys/s * 3*10^7 s/year * 10 year = 3*10^26 keys. ... In year 700-709 you will test 2^70 *10^9 keys/s * 3*10^7 s/year * 10 year = 3*10^38 keys. So even with very modest assumptions we are not talking millions of years, but instead 700 years. And if we assume hardware and better algorithms improve by 2x every year (which historically is closer to reality) then we are talking 70 years.

[@gregorymalchuk272]

It might become a problem if we achieve biological immortality. Though I doubt if computing power can increase indefinitely. I think it is limited by the speed of light and information density per thermodynamics.

[@CraftBasti]

70 Years per file? I hope you pick the right one to crack and don't regrett your choice when you hear what it said on your deaths bed

[@OleTange]

@@CraftBasti You are missing the point. If you think your protection is millions of years, you may be tempted to scale down to 100's of years. But that would be devastating if the true protection is 70 years instead of millions.

[@JuicyJonesHQ]

Nonsense, your assumptions are wrong.

[@OleTange]

@@JuicyJonesHQ Yet you provide exactly zero (0) evidence that the assumptions are wrong. Can you understand why people will not believe you?

[@esprit101]

The thumbnail looked a bit like Spoony had gotten his act together xD

[@douggief1367]

Once back door to rule them all.

[@michaelwinter742]

Obviously used a green screen. Odd choice of backgrounds. Otherwise, difficult to tell it was a robot. Welcome to the other side of the uncanny valley!

[@zaboomafia]

I hope you become the next Frodo Baggins

[@PebblesChan]

AES/Rijindael is just Belgian waffle!