Increased AES key lengths vs keyphrase entropy

Question

I'm selecting an AES key size for a LUKS partition using XTS-PLAIN64.

XTS will effectively reduce the AES key strength in half.

The default key size for AES XTS-PLAIN64 is 256 bits (meaning 128 bits effective). Given exponential progress making quantum computing ever more a reality, I was thinking to increase the key size.

I believe that AES is only defined on key sizes of 128, 192 and 256 bits, but cryptsetup/LUKS does allow me to select a key size of 384 or 512 bits.

I am aware that in theoretical related-key attacks certain cases AES256 may be less secure than AES192, but I'm not going to be using related keys.

1. What are the implications of using a 384- or 512-bit AES key?

2. Even if using XTS with AES256 (128 bit effective strength), would my 90-bit entropy keyphrase and 15,000 PBKDF2 iterations of SHA-512 still be the weakest link in the chain?

3. How would I work out how many bits of entropy and iterations are needed to make the keyphrase and the AES128 encryption the equal-weakest links in the chain?

If you could answer using finger-puppets in preference to complex formulae (where possible), that would be appreciated - I'm relatively new to the world of crypto.

Answer 1

I believe that AES is only defined on key sizes of 128, 192 and 256 bits, but cryptsetup/LUKS does allow me to select a key size of 384 or 512 bits.

AES itself is only defined for 128, 192 and 256 bits keysize.

However, XTS involves two instances of AES which can (and should) be keyed independently, meaning XTS-AES-256 really is 2 instances of AES-128 and 384 is two instances of AES-192 and 512 is two instances of AES-256.

Even if using XTS with AES256 (128 bit effective strength), would my 90-bit entropy keyphrase and 15,000 PBKDF2 iterations of SHA-512 still be the weakest link in the chain?

A break of AES by a quantum computer is stil decades away given the current state of quantum computers. Honestly I wouldn't worry about it if I'd need to worry about secrecy for less than say 50 years.

And yes your 90-bit-entropy passphrase will still be the weakest link. After all to brute-force that password, one would need about $2^{104}$ SHA-512 evaluations which is still much faster than even the "weak" $2^{128}$ AES evaluations. To get a comparable security level you either need to pick a (longer) passphrase or increase the iteration count by about $2^{20}$ which is about a million, meaning you'd be looking at 15 billion iterations which will take a lot of time to the point where it won't be acceptable to wait.

How would I work out how many bits of entropy and iterations are needed to make the keyphrase and the AES128 encryption the equal-weakest links in the chain?

To brute-force an $n$-bit key, you need about $2^n$ operations. To brute force a password with $k$ bits of entropy you need about $2^k$ operations and you can slow this down by a factor of $t$ which is the iteration count (in this case, you can also use more memory which will make attacks more expensive). So what you want, is:

$$\log_2(t) + k=n$$