Is AES still secure considering all this NSA/Snowden scandal? Im trying to understand if nowadays using AES is secure or not, after reading some arguments on Schneier’s blog (to be more exact, a comment to “The NSA Is Breaking Most Encryption on the Internet”) it seems like it is not secure:

Now as the NSA GCHQ et al know very well the more efficient you make the implementation of crypto code the more side channels it has unless extreme caution is observed. One thing we do know is that optimized for speed and minimized number of gates is an almost certain guarantee of side channels no matter how clever you are. Also the NSA knew that developers would not write their own code they would simply download and use the competition candidate code.
As was pointed out and demonstration code exploited implementations of AES were subject to timing attacks that could fully leak the key across a network connection due to &quot;cache hits&quot; on the Intel x86 platform from base level pentiums upwards within weeks of the winning candidate being announced. Even today there are very side channel suseptable AES implementations in use in fact the majority of those implementations on the likes of routers and switches are timing channel cursed as are most application level software implementations that are more than a year or so old...

…at least not if the computer used is connected to external network.
Is this true or just based on assumptions?
Let's clear some bullshit first:


  Now as the NSA GCHQ et al know very well the more efficient you make the implementaiton of crypto code the more side channels it has unless extream caution is observed. One thing we do know is that optomised for speed and minimized number of gates is an almost certain guarentee of side channels no matter how clever you are. 


The horrendous spelling issues aside, this is absolute bullshit. On almost any CPU there are only three things in symmetric crypto that introduce side-channels:


Branches dependent on secret data.
Table lookups with an index dependent on secret data.
CPU instructions that take non-constant time/power.


AES suffers from potential side-channel attacks because the obvious implementation of the S-box violates #2, and the obvious implementation of polynomial multiplication violates #1. Both issues can be avoided using trickery, though.

But in general you can optimize all you want as long as you don't branch on secret data, don't do table lookups with secret data and make sure that the CPU instructions you use always take the same amount of power and time (notable violaters of this are multiplication instructions in many lesser-known CPUs).



As to the question in the title, AFAIK Snowden has not published any documents that show cryptanalysis against AES, so AES is still as secure as before. I do not know whether Snowden published documents of the NSA abusing side-channels, however I wouldn't be surprised (or worried) at all if he did. Side-channels were long overlooked and many old implementations suffer from them. Modern day implementations are much more aware and as such don't suffer from them.