Chacha20_Poly1305

[rugk]

@My1

1 The attacks on AES256 are mostly related key attacks, -> e.g. bad RNG -> your server is unsecure anyway

AES 256 is considered more vulnerable to timing attacks than AES 128bit.
This was mentioned already a few times when talking about why Certbot prefers 128bit AES ciphers.
See this thread e.g.:

Cipher Suite Order - Apache

A…

@My1

2 Performance part is mostly important on the server and not THAT much on the client because a server has far more simultaneous connects than the client.

Performance is not a real concern. And AFAIK whether to use AES 128 or 256bit affects both the client and the server.

@My1

3 when quantum comes the effective security is effectively halved meaning that you AES128 becomes essentially 64bit of security which is iirc pretty broken and AES256 becomes 128 bits effective security which will hold out a lot longer.

Quantum computers cannot break symmetric encryption! Only asymmetric encryption is endangered by quantum computers. Thus AES is not endangered. And the additional 128bit would not matter anyway, I think.

@Osiris

You tell that to the folks at Mozilla and Google

But before you do, please inform yourself why they made this decision. They have many clever people there, so you can be almost sure they have a good reason for doing something the way they do.