# Does the secret key used in AES have to prime?

I’ve looked around this site and the web quite a bit, but can’t find a definitive answer on whether or not the secret key $k$ used in the AES crypto-system has to be a prime number? Or can you just use any random values for the $128,192$ or $256$ bit long keys?

As a personal educational exercise, I’m working on my own implementation of AES, but my only other crypto experience is with the RSA crypto-system, though rather an elementary understanding, where the keys need to be prime, so I guess I just assumed the key for AES did as well. From what I gather the answer is “no”, but I don’t know enough about AES yet, to know whether or not that makes any difference?

-
Just curious: are you building your implementation of AES for personal education, or are you planning to use it in production systems? – Erik Forbes May 12 '14 at 8:20
Figured this would be asked, so proactively addressed that in my original question. – Finding Nemo 2 is happening. May 12 '14 at 15:47
Please note that RSA doesn't use prime keys, but (usually) semi-prime ones (which are a product of two primes). – Paŭlo Ebermann May 12 '14 at 17:38
Oh, wow - somehow I completely missed the first four words of the second paragraph of your question. o.O – Erik Forbes May 19 '14 at 21:25

No, it does not have to be a prime.

All you need is an appropriately long and random key:

• AES-128 = expects key-length of 16 raw/binary bytes (= 128 / 8 bits per byte)
• AES-192 = expects key-length of 24 raw/binary bytes (= 192 / 8 bits per byte)
• AES-256 = expects key-length of 32 raw/binary bytes (= 256 / 8 bits per byte)

As a practical example, you could use a hashing function like to generate a key from a random password, or from a Diffie-Hellman session key, or from an RSA session key, etc. Of course, if it does not conflict your individual purposes, you would be advised to use a deliberately slow key derivation function such as , , or together with a random salt instead of SHA-2… but let’s stick with SHA-2 to keep it easy.

Depending on the implementation, SHA-2 will return either raw binary bytes, or – more likely – a hex string representing those raw binary bytes. AES-256 for example takes a 32 byte key, which corresponds to 64 characters in hex encoding. All you need to do is to use those bytes SHA-256 returned as a key for AES-256 and you’re set.

In pseudo-code, it would go something like this:

plaintext = "This is top secret!"
key = sha256("This is the password.")
iv = cryptographically_secure_rng();
ciphertext = aes256(plaintext, key, iv);
-
The archetipal example of generating an AES key should be: randomly, not from a password. And when generating a key from a password, one MUST NOT just use a hash, because the system ends up being awfully vulnerable to password cracking; instead, one must use key stretching, by using a slow password-based key derivation function, like SCRYPT, BCRYPT, or PBKDF2. Ah I see that's described now. – fgrieu May 12 '14 at 5:00
@fgrieu Yep, I was still editing it. Also, note that I merely used the hashing reference as an example to keep it easy… and to be honest, I didn’t want to dive into all KDFs and how to use them, since that would certainly be a bit too much as an answer to a question that only asked if AES keys need to be primes. ;) – e-sushi May 12 '14 at 5:14

AES is based on shuffling and XOR operations. Therefore, unlike in RSA, primality plays no role in AES.

Any key generated from a cryptographic-quality random number generator should do. Issues to watch out for are weak keys (to my knowledge, there are none in AES) and related-key attacks (don't encrypt the same message with keys that resemble each other and you should be fine).

-