My intuition tells me it's a trade off between speed and security, but how did the standardisation process select these three seemingly arbitrary key lengths (namely, AES-128, AES-192, AES-256).
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
Prompted by Paŭlo's comment, I took a look at the original requirements set out for the AES candidates. A useful page for that turns out to be AES - The Early Years (1997-98) on the NIST web site (and surprisingly hard to find there; the internal links are broken and Google doesn't find it either).
The AES key lengths were specified in the original Request for Candidate Algorithm Nominations for the AES published in the Federal Register on September 12, 1997, in section 3, Minimum Acceptability Requirements (emphasis original):
So where did those key/block size combinations come from? In the earlier notice Announcing Development of a Federal Information Processing Standard For Advanced Encryption Standard, posted in the Federal Register on January 2, 1997, the "proposed draft minimum acceptability requirements and evaluation criteria" include:
Apparently, the three key sizes and one block size specified in the NIST minimum requirements, and later in the AES standard, were selected at least in part based on those discussions.
Ps. I've seen it claimed, e.g. by Thomas Pornin in this answer, that the three key lengths "exist mostly to satisfy some US military regulations which call for the existence of several distinct 'security levels'". The notes and comments cited above strongly suggest to me that this probably wasn't the only reason for the decision to require multiple key lengths, although it could certainly have been one reason. In any case, if anyone can actually point to the specific regulations that require these distinct security levels (assuming they're publicly available), I'd be interested in seeing them.