Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to construct an AES key from an array of bytes (in Java), but I first I have to check if the key created from these bytes would be weak.

Java can check for weakness for DES, but not for AES. What are the criteria for an AES key to be considered weak?

share|improve this question
It has no (known) weak keys. And even with DES, rejecting "weak" keys is silly. – CodesInChaos Mar 22 at 19:26
Just make sure the array of bytes is the output of a cryptographically-secure random number generator. – Stephen Touset Mar 22 at 19:42
Some hints on generating keys for Java here – Maarten Bodewes Mar 22 at 20:58
Ironically, DES's weak keys are now weak because they're well known (i.e. the same reason 01:23:45:67:89:AB:CD is "weak"), perhaps more so than because of their mathematical properties. I.e. if you think something was encrypted with a weak key, then instead of trying to exploit their properties, you may as well just try decrypting it with all 16 of them! – immibis Mar 22 at 23:56

The comments already have covered the two main points, but let me try to put it in the form of an answer. There are not (that we know) weak keys in AES, in the sense that you cannot formulate a routine $isWeak(key)$. However, there are weak ways to generate an AES key (i.e. bad randomness).

An AES key is just a bit string of length $n$. That means that there are $2^n$ possible keys. If the key is generated by a properly seeded CSPRNG, AES is (computationally) secure. If you don't know about the origins of the key, or it is generated by a less secure RNG (such as Java's Math.random), the key shouldn't be used.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.