hal(_at_)rain(_dot_)org wrote:
128 bits
is really very strong still, but if we do want to go up, 192 seems more
reasonable to me than 256. That would be my recommendation.
What would be the *disadvantage* of choosing 256 bits? I can see the
potential advantage if quantum computing does become feasible in the next
decade or so, but I can't see any real disadvantage; as far as I'm aware
we'd just have a slightly larger data size and a slightly longer key setup
time.
If that's the case and we only have one key size, I'd say go for 256 bits
because it has potential advantages which could significantly outweigh the
minor disadvantages.
Mark