# Does AES-128 have the same strength as AES-256 with a padded key?

When I use the same 128-bit key for AES-128 and AES-256 with a known/public padding for the latter,
is there some weakness in AES-256 that is not present in AES-128 with essentially the same key?

This might be the case when I'm receiving the key from an
algorithm which just doesn't produce enough bits (128 or less).
Is it better to use AES-128 in this case or can I use AES-256 with an one-size-fits-all attitude?

I feel like the answers in this question answer my question,
but don't explicitly state the effectively used key size.

-
if you use a good expansion (e.g. SHA256(key)), AES-256 will be stronger against cryptoanalysis since it has 14 rounds instead of just 10. For the same reason AES-256 has lower performance than AES-128. –  CodesInChaos Apr 14 '14 at 13:47
@CodesInChaos So, you mean instead of padding. That should make it considerably better. I agree, but what about padding? –  Artjom B. Apr 14 '14 at 13:51
I wouldn't be confident in too simply paddings since the AES key schedule is relatively weak. Each half of the 256 bit key gets mixed in less often compared with the 128 bit key since AES-256 only as 1.4 times as many rounds, not twice as many. The additional rounds might compensate for the weaker key schedule in padded AES-256 compared with AES-128, but it certainly feels risky. It might be better to simply concatenate the 128 bit key to itself which at least mixes in the key more often. –  CodesInChaos Apr 14 '14 at 15:21
While simple padding might not cause any immediate weaknesses, I strongly recommend using random keys uniformly distributed over all 256 bits. That's the way AES has been analyzed, that's what's modeled by a PRP (pseudo-random-permutation) helping with security proofs and it avoids concerns over the weak schedule. Use a proper PRF or hash to expand the key not such an ad-hoc scheme. –  CodesInChaos Apr 14 '14 at 15:23

In this scenario, it is better to use AES-128 than AES-256 if you are to 0-pad a 128-bit key to 256 bits.

If you 0-pad, the round key for round 1 is all 0s, and round 3 is effectively worthless as well. So now you are down to 12 effective rounds vs 10 for AES-128.

Then you need to look at the effectiveness of the remaining keys. Here are some example key schedules for AES-256 (0-padded 128-bit key) and AES-128:

00  a1b625fe 019e24c8 0a7f661b 9ad9d51c    00  a1b625fe 019e24c8 0a7f661b 9ad9d51c
01  00000000 00000000 00000000 00000000
02  c2d5469c c34b6254 c934044f 53edd153    01  3d0e10fc 3c903434 36ef522f ac368733
03  ed553eed ed553eed ed553eed ed553eed
04  9780ba2c 54cbd878 9dffdc37 ce120d64    02  fe9f15e9 c20f21dd f4e073f2 58d6f4c1
05  669ce9ae 8bc9d743 669ce9ae 8bc9d743
06  8dbd6726 d976bf5e 44896369 8a9b6e0d    03  86f5e352 44fac28f b01ab17d e8cc45bc
07  18887679 9341a13a f5dd4894 7e149fd7    04  e36ea834 a7946abb 178edbc6 ff429e7a
08  834e9df5 5a3822ab 1eb141c2 942a2fcf    05  3978842f 9eecee94 89623552 7620ab28
09  3a6d63f3 a92cc2c9 5cf18a5d 22e5158a    06  0d40336d 93acddf9 1acee8ab 6cee4383
10  fddd44bc a7e56617 b95427d5 2d7e081a    07  e1101b37 72bcc6ce 68722e65 049c6de6
11  e29e5351 4bb29198 17431bc5 35a60e4f    08  6fe2c58b 1d5e0345 752c2d20 71b040c6
12  794b6037 deae0620 67fa21f5 4a8429ef    09  db412299 c61f21dc b3330cfc c2834c3a
13  34c1f68e 7f736716 68307cd3 5d96729c    10  5b64ce86 9d7bef5a 2e48e3a6 eccbaf9c
14  a707f037 79a9f617 1e53d7e2 54d7fe0d


Round 5 is effectively 64-bits instead of 128, and while you cannot see it with this example, rounds 2 and 4 are also very linear with respect to subkey 0, and only at round 6 do we see a level of acceptable nonlinearity (we get this at round 3 with the 128-bit key schedule). Further nonlinear expansion is also slower, I would suggest the final round keys are similarly linear to the original key for both key schedules.

It is probable that even with the extra 4 rounds, the full AES-256 cipher with the padded key will be weaker than AES-128 against a variety of attacks, while taking 40% more time to encrypt. As CodesInChaos suggested, expanding a 128-bit key to 256-bits using a cryptographic hash will result in a stronger cipher than AES-128 while still only having an effective key size of 128-bits. I would not recommend duplication of the key to expand to 256-bits, round key linearity is still high, and it is probable existing attacks will be more effective.

-
And yes, padding that is non 0 has the same problems –  Richie Frame Apr 15 '14 at 10:41
Full zero subkey does not make the round worthless. 10-round AES-256 is out of reach by standard cryptanalytic attacks, and it remains so even if you set some of the key bits (128 or even 192) to zero. –  Dmitry Khovratovich Apr 15 '14 at 14:33
We can both agree that 14 rounds is better than 10, but the 256-bit key schedule is weaker. AES-256 with a 128-bit key is weaker than AES-128 extended to 14 rounds, the question is how much weaker. Do related key attacks now apply? Can the subkey alignment allow new attacks? What about non public attacks? –  Richie Frame Apr 16 '14 at 1:35

AES-256 with $b$ bits of its key known is still secure against key recovery attacks with security level $(256-b)$ bits. Otherwise a shortcut key recovery attack on the regular AES-256 would exist, and the only known attack of this kind -- biclique attack -- does not scale to such subsets of the key space.

-