I'm making a digital-asset manager written in ActionScript 3, it will be used to manage highly sensitive information. I'm using the AS3Crypto library (which has quite a good reputation) to implement AES encryption.
When I encrypt data using the AS3Crypto library, using AES-CBC, and a 256-bit key, I'm able to successfully decrypt it with php/mcrypt using the same key/iv. That is to say, the AS3Crypto implementation seems fine.
When I use a key longer than 256-bits, I'm able to successfully encrypt it and decrypt it with the AS3Crypto library. Changing just 1 character in key causes the decryption to fail, indicating that the full key is indeed being used, and not truncated to 256-bit. However, when I try to decrypt the cipher with mcrypt, it fails (unsurprisingly, as the specification for AES states a maximum key-size of 256-bits).
My questions are, taking the below assumptions into consideration, will using a key longer than 256-bits introduce some sort of vulnerability into the encryption? And if not, will using a longer key theoretically increase resistance from brute-force attacks?
- I understand that a 256-bit key is sufficiently strong
- encryption will only take place client-side with the AS3Crypto library, and hence doesn't necessarily need to be compatible with other implementations
- the key is a string containing random alpha-numeric characters, and is not derived from a PBKDF
- even if using a key longer than 256-bit is overkill, the extra security that it might offer would be appreciated