# Would this 3AES-192 scheme achieve 384-bit key security with just a 384-bit key?

For starters, I don't need any don't-roll-your-crypto stuff. We're discussing a hypothetical.

So the idea is 3DES needs 3x the key size and achieves only 2x key size bit security. So using the 3x keyspace is essential for achieving the 2x bit security. Now entertain the same example, but this time it's 3AES-192. We have encrypt(K1, decrypt(K2, encrypt(K3))) and the reverse for decryption, using 3x unique 192-bit keys. So we need a 576-bit key to break up into 3 smaller keys to achieve 2x 192 = 384 bit security.

Now consider we were to have just a 384-bit key, and we were to do the following:

K1 = BLAKE3-192(key || 0x01)

K2 = BLAKE3-192(key || 0x02)

K3 = BLAKE3-192(key || 0x03)


to derive the 3 keys deterministically. I picked BLAKE3 for speed, also this setup eliminates related-key attacks. My question is, would this scheme still have the 2x 192 = 384 bits of security despite using only a 384-bit key. The scheme for triple chaining a block cipher states that a key 3 times the size is required to obtain 2 times the security, does this kind of deterministic setup get around that?

• The short answer is yes. The long answer is too deep... Commented Feb 8 at 9:26
• I won't go for the "don't roll your own", but I'd wonder why AES-256 isn't an option, why more than 256 or even 192 bit security is even needed. And, in practice, a lot of AES modes now use CTR (counter mode) or a derived scheme (GCM, EAX, CCM etc.) which means that you don't need decryption. If you don't need backwards compatibility with AES-192 it also makes more sense to use the cipher it in one direction. Commented Feb 8 at 9:45
• Useful reference: Mihir Bellare and Phillip Rogaway, Code-Based Game-Playing Proofs and the Security of Triple Encryption, eprint 2004-2008, originally in proceedings of Eurocrypt 2006,
– fgrieu
Commented Feb 8 at 10:00