I made two Linux kernel modules of Hasty Pudding Cipher with key size of 16896-bits (16384-bits key + 512-bits tweak also called "spice), one has 512-bits of block size, the other 128-bits.
I would like to use the 128-bits block size version with XTS in Linux, but I read an answer here in the forum saying that AES-256 in XTS mode can be broken with less effort than brute-forcing the two 256-bits XTS keys together.
Two XTS keys of 16896-bits each would result in 33792-bits of key material, but what would be the effective security when using this large key size with a block size of only 128-bits?
Would the attack described in that answer apply in this case?
