1
$\begingroup$

When taking AES for example, the number of rounds increases as the key size increases.

This is done in order to adequately diffuse key bits into the state of the cipher.

Suppose you replace the AES key schedule with SHAKE (SHA-3).

Would such round expansion be necessary? Since every bit of the key would influence every bit of every round key.

Improve this question
$\endgroup$
5
  • $\begingroup$ If we use SHAKE, we then wouldn't be bothering to use keyed permutation with small block size such as AES. We'd be constructing ciphers directly out of the Keccak permutation directly (with Duplex mode). $\endgroup$
    – DannyNiu
    Commented Nov 17, 2023 at 1:11
  • $\begingroup$ @DannyNiu There are a multitude of scenarios where round key generation is computationally irrelevant, and a fast block cipher is just fine. And it doesn't address the question at all. $\endgroup$
    – LightTunnelEnd
    Commented Nov 17, 2023 at 2:02
  • $\begingroup$ Look at the differential attacks and linear attacks on the AES. Even the independent round key cannot increase the security like demonstrated for DES. So the rounds are determined against the attacks and the AES team had very high confidence about it and we have more than 20 years of attack on it. The round key expansion was designed to be a cheap operation. $\endgroup$
    – kelalaka
    Commented Nov 17, 2023 at 6:04
  • $\begingroup$ "This is done in order to adequately diffuse key bits into the state of the cipher." - is this actually the motivation? $\endgroup$
    – poncho
    Commented Nov 17, 2023 at 14:26
  • $\begingroup$ What about the last round key? How much they are diffused? $\endgroup$
    – kelalaka
    Commented Nov 17, 2023 at 17:36

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.