# a doubt in Rijndael's key expansion sizes

I've often heard/read that AES key sizes 256 & 192 would be weaker than 128 or not stronger as expected from the size increase, but I've never seen a proof. How does one proof the strength of a Rijndael key size?

If I understand correctly, the main effect of having the key size different from the block size is on the key expansion. The iterative algorithm is moving along the columns, but the key size determines the number of columns. Later, this expansion is used in the addRoundKey() by taking sets that fit with the number of columns due to the block size.

I've been trying to understand, assuming this issue would be correct, from where this would come from.

-

## migrated from security.stackexchange.comFeb 9 '14 at 13:57

This question came from our site for Information security professionals.

Therefore, AES-128 uses its key more intensively, and AES-192 and AES-256 -- less intensively. However, only very specific cryptanalytic attacks may exploit this property. For example, related-key attack can break the entire AES-256, but can not break the full AES-128. By ''break'' we mean that it is possible to produce similar'' ciphertexts from ''similar'' plaintexts on some particular key pairs. However, the related keys are rarely seen in practice, so this property is not much relevant to the actual security of AES.