# Why is Rijndael key length restricted?

Why is Rijndael restricted to key length in $\lbrace 128, 160, 192, 224, 256\rbrace$ bits (and not larger)? The algorithm looks to me like it would support an arbitrary-sized key (multiple of $32$).

The rounds operate without the key. Between rounds, the state is XORed with as many key bytes as are needed according to the block size. The key generation process is dependent on the number of rounds, which is dependent on key size, so growing a key triggers a process that uses the key data.

I heard Dr. Eric Cole mention something about this like 10 years ago when first I took one of his classes which covered a "101" into to crypto. We were talking about how AES is replacing DES (triple DES, whatever) and he told us about basically said that Rijndael has variable key lengths. He didn't say specifically, but I took him to mean arbitrary. If I recall corrected he said that because of this feature we'd be using it for a long long time to come. He also talked about all the fun he had attending the NIST AES contests, but now I'm off topic. Does anyone actually know?

• Probably because the designer didn't see a point in supporting keys larger than 256 bits. It's not like a conventional computer will ever brute-force 256 bits, and even with a quantum computer it's pretty expensive. – CodesInChaos Sep 5 '14 at 8:44