What are the practical differences between 256-bit, 192-bit, and 128-bit AES encryption?

Question

AES has several different variants:

• AES-128
• AES-192
• AES-256

But why would someone prefer use one over another?

Answer 1

For practical purposes, 128-bit keys are sufficient to ensure security. The larger key sizes exist mostly to satisfy some US military regulations which call for the existence of several distinct "security levels", regardless of whether breaking the lowest level is already far beyond existing technology.

The larger key sizes imply some CPU overhead (+20% for a 192-bit key, +40% for a 256-bit key: internally, the AES is a sequence of "rounds" and the AES standard says that there shall be 10, 12 or 14 rounds, for a 128-bit, 192-bit or 256-bit key, respectively). So there is some rational reason not to use a larger than necessary key.

A larger key size also resists better to large quantum computer attacks: Using Grover's algorithm, a brute-force attack on any k-bit key block cipher would only take $O(2^{k/2})$ steps, so a 256-bit key would still give 128-bit security, while a 128-bit key could be cracked in 2^64 operations, which is doable. But as far as I know, the threat of QC was an ulterior rationalization; also, it does not explain the 192-bit key size. (And quantum computers of this size are not yet in sight for the next some years.)

Answer 2

The actual encryption algorithm is almost the same between all variants of AES. They all take a 128-bit block and apply a sequence of identical "rounds", each of which consists of some linear and non-linear shuffling steps. Between the rounds, a round key is applied (by XOR), also before the first and after the last round.

The differences are:

• The longer key sizes use more rounds: AES-128 uses 10 rounds, AES-192 uses 12 rounds and AES-256 uses 14 rounds.
• The derivation of the round keys looks a bit different.

For AES-128, we need 11 round keys, each of which consisting of 128 bits, i.e. 4 32-bit columns. The original cipher key consists of 128 bits (i.e. 4 columns). Call these $k_0$, $k_1$, $k_2$ and $k_3$. The key expansion algorithm now expands these to $k_0$ to $k_{43}$ (so we get 44 columns in total).

The key expansion works in a way that $k_i$ only depends directly on $k_{i-1}$ and $k_{i -N_k}$ (where $N_k$ is the number of columns in the key, i.e. 4 for AES-128). In most cases it is a simple $\oplus$, but after each $N_k$ key columns, a non-linear function $f_i$ is applied.

                              ┏━━━┓
   k_0    k_1    k_2    k_3 ─→┃f_1┃─╮
    │      │      │      │    ┗━━━┛ │
 ╭──│──────│──────│──────│──────────╯
 │  ↓      ↓      ↓      ↓
 ╰─→⊕   ╭─→⊕   ╭─→⊕   ╭─→⊕
    │   │  │   │  │   │  │
    ↓   │  ↓   │  ↓   │  ↓    ┏━━━┓
   k_4 ─╯ k_5 ─╯ k_6 ─╯ k_7 ─→┃f_2┃─╮
    │      │      │      │    ┗━━━┛ │
 ╭──│──────│──────│──────│──────────╯
 │  ↓      ↓      ↓      ↓
 ╰─→⊕   ╭─→⊕   ╭─→⊕   ╭─→⊕
    │   │  │   │  │   │  │
    ↓   │  ↓   │  ↓   │  ↓     ┏━━━┓
   k_8 ─╯ k_9 ─╯ k_10 ╯ k_11 ─→┃f_3┃─╮
    │      │      │      │     ┗━━━┛ │
 ╭──│──────│──────│──────│───────────╯
 │  ↓      ↓      ↓      ↓
.......................................
 │  ↓      ↓      ↓      ↓
 ╰─→⊕   ╭─→⊕   ╭─→⊕   ╭─→⊕
    │   │  │   │  │   │  │
    ↓   │  ↓   │  ↓   │  ↓
   k_40 ╯ k_41 ╯ k_42 ╯ k_43

The functions $f_i$ are nonlinear functions build from the AES S-box (applied on each byte separately), a rotation by one byte, and an XOR with a round constant depending on $i$ (this is the element of $GF(2^8)$ corresponding to $x^{i-1}$, but there also is a table in the standard).

Then the key selection algorithm simply takes $k_0 \dots k_3$ as the first round key, $k_4\dots k_7$ as the second one, until $k_{40} \dots k_{43}$ as the last one.

AES-192 looks almost the same, but with six columns in parallel (A similar diagram you can see in my answer to a different question). As we need 13 round keys (=52 key columns), this will be done until $k_{51}$ (i.e. 8 full rows and four keys in the ninth row).

For AES-256 (and all variants of Rijndael with more than 192 bits of key), there is an additional non-linear transformation after the fourth column:

                                                             ┏━━━┓
  k_0    k_1    k_2    k_3       k_4    k_5    k_6    k_7 ──→┃f_1┃─╮
   │      │      │      │         │      │      │      │     ┗━━━┛ │
╭──│──────│──────│──────│─────────│──────│──────│──────│───────────╯
│  ↓      ↓      ↓      ↓     ┏━┓ ↓      ↓      ↓      ↓
╰─→⊕   ╭─→⊕   ╭─→⊕   ╭─→⊕   ╭→┃g┃→⊕   ╭─→⊕   ╭─→⊕   ╭─→⊕
   │   │  │   │  │   │  │   │ ┗━┛ │   │  │   │  │   │  │
   ↓   │  ↓   │  ↓   │  ↓   │     ↓   │  ↓   │  ↓   │  ↓     ┏━━━┓
  k_8 ─╯ k_9 ─╯ k_10 ╯ k_11 ╯    k_12 ╯ k_13 ╯ k_14 ╯ k_15 ─→┃f_2┃─╮
   │      │      │      │         │      │      │      │     ┗━━━┛ │
╭──│──────│──────│──────│─────────│──────│──────│──────│───────────╯
│  ↓      ↓      ↓      ↓     ┏━┓ ↓      ↓      ↓      ↓
╰─→⊕   ╭─→⊕   ╭─→⊕   ╭─→⊕   ╭→┃g┃→⊕   ╭─→⊕   ╭─→⊕   ╭─→⊕
   │   │  │   │  │   │  │   │ ┗━┛ │   │  │   │  │   │  │
   ↓   │  ↓   │  ↓   │  ↓   │     ↓   │  ↓   │  ↓   │  ↓     ┏━━━┓
  k_16 ╯ k_17 ╯ k_18 ╯ k_19 ╯    k_20 ╯ k_21 ╯ k_22 ╯ k_23 ─→┃f_3┃─╮
   │      │      │      │         │      │      │      │     ┗━━━┛ │
╭──│──────│──────│──────│─────────│──────│──────│──────│───────────╯
│  ↓      ↓      ↓      ↓         ↓      ↓      ↓      ↓
....................................................................
│  ↓      ↓      ↓      ↓     ┏━┓ ↓      ↓      ↓      ↓
╰─→⊕   ╭─→⊕   ╭─→⊕   ╭─→⊕   ╭→┃g┃→⊕   ╭─→⊕   ╭─→⊕   ╭─→⊕
   │   │  │   │  │   │  │   │ ┗━┛ │   │  │   │  │   │  │
   ↓   │  ↓   │  ↓   │  ↓   │     ↓   │  ↓   │  ↓   │  ↓     ┏━━━┓
  k_48 ╯ k_49 ╯ k_50 ╯ k_51 ╯    k_52 ╯ k_53 ╯ k_54 ╯ k_55 ─→┃f_7┃─╮
   │      │      │      │                                    ┗━━━┛ │
╭──│──────│──────│──────│──────────────────────────────────────────╯
│  ↓      ↓      ↓      ↓
╰─→⊕   ╭─→⊕   ╭─→⊕   ╭─→⊕
   │   │  │   │  │   │  │
   ↓   │  ↓   │  ↓   │  ↓
  k_56 ╯ k_57 ╯ k_58 ╯ k_59

$g$ is a simpler variant of $f_i$: simply the application of the AES S-box on every byte of the column in parallel (without the rotation or the round constant, thus without an index).

Here we need 15 round keys, i.e. 60 columns, which means to do seven and a half round of key expansion.

(I now did read the word practical in the question, and my post doesn't really apply here ... but there seems to be no better question to post this as an answer, so I still post it here.)

Answer 3

In my opinion, if AES-128 is broken, then it's highly likely that AES-192 and AES-256 will fall too (because these types of attacks are structural and easily extend to longer key-lengths). In fact, we know a successful attack on AES will not be via exhaustive key search on a conventional computer.

There is, however, some chance that key-size will matter in face of a practical attack: suppose the attack takes about the square-root of the size of the key-space (kind of like a collision-attack on hash functions; in fact, quantum computers will give this kind of speedup on exhaustive key search via Grover's Algorithm). Then the square-root of $2^{128}$ becomes practical whereas the square-root of $2^{256}$ remains out of reach. Nevertheless, I guarantee you if AES-128 falls, people will quickly migrate away from the longer-key variants out of worry that they will fall too.

Attacks don't get worse... they only get better.

Answer 4

The difference is that all known attacks on AES [but see comments] require in the neighborhood of 2^length attempts to succeed; that is, there's no better method known than simply trying different keys by brute force.

It follows, then, that a 256 bit key is 2¹²⁸ times as hard to crack as a 128 bit key.

Of course, computing each encrypted block with 256 bit keys is harder too.

The choice of key length should be based on risk: the damage that will be done if an attack is successful.