7
$\begingroup$

I’ve looked around this site and the web quite a bit, but can’t find a definitive answer on whether or not the secret key $k$ used in the AES crypto-system has to be a prime number? Or can you just use any random values for the $128,192$ or $256$ bit long keys?

As a personal educational exercise, I’m working on my own implementation of AES, but my only other crypto experience is with the RSA crypto-system, though rather an elementary understanding, where the keys need to be prime, so I guess I just assumed the key for AES did as well. From what I gather the answer is “no”, but I don’t know enough about AES yet, to know whether or not that makes any difference?

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ Please note that RSA doesn't use prime keys, but (usually) semi-prime ones (which are a product of two primes). $\endgroup$
    – Paŭlo Ebermann
    Commented May 12, 2014 at 17:38

2 Answers 2

Reset to default
6
$\begingroup$

No, it does not have to be a prime.

All you need is an appropriately long and random key:

  • AES-128 = expects key-length of 16 raw/binary bytes (= 128 / 8 bits per byte)
  • AES-192 = expects key-length of 24 raw/binary bytes (= 192 / 8 bits per byte)
  • AES-256 = expects key-length of 32 raw/binary bytes (= 256 / 8 bits per byte)

As a practical example, you could use a hashing function like to generate a key from a random password, or from a Diffie-Hellman session key, or from an RSA session key, etc. Of course, if it does not conflict your individual purposes, you would be advised to use a deliberately slow key derivation function such as , , or together with a random salt instead of SHA-2… but let’s stick with SHA-2 to keep it easy.

Depending on the implementation, SHA-2 will return either raw binary bytes, or – more likely – a hex string representing those raw binary bytes. AES-256 for example takes a 32 byte key, which corresponds to 64 characters in hex encoding. All you need to do is to use those bytes SHA-256 returned as a key for AES-256 and you’re set.

In pseudo-code, it would go something like this:

plaintext = "This is top secret!"
key = sha256("This is the password.")
iv = cryptographically_secure_rng();
ciphertext = aes256(plaintext, key, iv);
Improve this answer
$\endgroup$
2
  • 7
    $\begingroup$ The archetipal example of generating an AES key should be: randomly, not from a password. And when generating a key from a password, one MUST NOT just use a hash, because the system ends up being awfully vulnerable to password cracking; instead, one must use key stretching, by using a slow password-based key derivation function, like SCRYPT, BCRYPT, or PBKDF2. Ah I see that's described now. $\endgroup$
    – fgrieu ♦
    Commented May 12, 2014 at 5:00
  • 3
    $\begingroup$ @fgrieu Yep, I was still editing it. Also, note that I merely used the hashing reference as an example to keep it easy… and to be honest, I didn’t want to dive into all KDFs and how to use them, since that would certainly be a bit too much as an answer to a question that only asked if AES keys need to be primes. ;) $\endgroup$
    – e-sushi
    Commented May 12, 2014 at 5:14
5
$\begingroup$

AES is based on shuffling and XOR operations. Therefore, unlike in RSA, primality plays no role in AES.

Any key generated from a cryptographic-quality random number generator should do. Issues to watch out for are weak keys (to my knowledge, there are none in AES) and related-key attacks (don't encrypt the same message with keys that resemble each other and you should be fine).

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.