I made two Linux kernel modules of Hasty Pudding Cipher with key size of 16896-bits (16384-bits key + 512-bits tweak also called "spice), one has 512-bits of block size, the other 128-bits.

I would like to use the 128-bits block size version with XTS in Linux, but I read an answer here in the forum saying that AES-256 in XTS mode can be broken with less effort than brute-forcing the two 256-bits XTS keys together.

Two XTS keys of 16896-bits each would result in 33792-bits of key material, but what would be the effective security when using this large key size with a block size of only 128-bits?

Would the attack described in that answer apply in this case?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.