a doubt in Rijndael's key expansion sizes

Question

I've often heard/read that AES key sizes 256 & 192 would be weaker than 128 or not stronger as expected from the size increase, but I've never seen a proof. How does one proof the strength of a Rijndael key size?

If I understand correctly, the main effect of having the key size different from the block size is on the key expansion. The iterative algorithm is moving along the columns, but the key size determines the number of columns. Later, this expansion is used in the addRoundKey() by taking sets that fit with the number of columns due to the block size.

I've been trying to understand, assuming this issue would be correct, from where this would come from.

Answer 1

AES-128 takes a 128-bit key, produces 11 128-bit subkeys out of it with a cryptographically weak function, and uses them in 10 internal rounds. It can be said that the full key is reused 10 times.

AES-192 takes a 192-bit key, produces 13 128-bit subkeys out of it (or, equivalently, 9 192-bit subkeys), and uses them in 12 rounds. The full key is reused 8 times.

AES-256 takes a 256-bit key, produces 15 128-bit subkeys (or 8 256-bit ones) and uses them in 14 rounds. The full key is reused 7 times.

Therefore, AES-128 uses its key more intensively, and AES-192 and AES-256 -- less intensively. However, only very specific cryptanalytic attacks may exploit this property. For example, related-key attack can break the entire AES-256, but can not break the full AES-128. By ''break'' we mean that it is possible to produce ``similar'' ciphertexts from ''similar'' plaintexts on some particular key pairs. However, the related keys are rarely seen in practice, so this property is not much relevant to the actual security of AES.

To conclude, AES-256 can be considered weaker than AES-128 in a very specific setting only, and this setting is unlikely to occur in practice.