# Tag Info

12

The most efficient related-key attacks on AES-256 and resulting weaknesses AES-256-based hash functions are summarized in my PhD thesis. Though collision and preimage attacks on hash functions are out of reach yet, the components of these functions still expose some properties that are not expected of good hash functions or random oracles. Getting to the ...

5

I don't know of any practical attacks on these schemes that would break collision-resistance or pre-image resistance, but the existence of related-key attacks on AES is still worrisome. The Miyaguchi-Preneel hash construction is better in this sense, because the attacker doesn't directly control anything that goes into the key input. Miyaguchi-Preneel is ...

2

In this scenario, it is better to use AES-128 than AES-256 if you are to 0-pad a 128-bit key to 256 bits. If you 0-pad, the round key for round 1 is all 0s, and round 3 is effectively worthless as well. So now you are down to 12 effective rounds vs 10 for AES-128. Then you need to look at the effectiveness of the remaining keys. Here are some example key ...

1

AES-256 with $b$ bits of its key known is still secure against key recovery attacks with security level $(256-b)$ bits. Otherwise a shortcut key recovery attack on the regular AES-256 would exist, and the only known attack of this kind -- biclique attack -- does not scale to such subsets of the key space.

Only top voted, non community-wiki answers of a minimum length are eligible