# Can Poly1305-AES be used with AES-256?

I'm reading through Bernstein's The Poly1305-AES message-authentication code.

The MAC is predicated on 16-byte block ciphers like AES and produces 16-byte authentication tags. However, Bernstein does not really discuss the block cipher's key sizes, other than to state its a 32-byte key comprised of a 16-byte key and a second 16-byte string r.

I presume Bernstein selected AES-128 because it met security requirements with the most efficiency (i.e., AES-128 is faster than AES-256 because it uses fewer rounds, among other stated criteria). (Bernstein talks about the selection of other parameters, like r, in the section Design Decisions).

If one desired, could Poly1305-AES be used with AES-256? In this case, a 48-byte key would be used.

• The question is not just if it can be replaced, the question becomes if it would be any more secure if you do. It seems the polynomial was chosen to provide $2^{106}$ bits of security. Changing the underlying cipher to 256 bits keys may not provide the same level of security increase ("may" means I'm really not sure either way, but it seems to me that it won't). – Maarten Bodewes Mar 29 '15 at 15:12
• @Maarten - agreed. I'm not really looking to improve theoretical security. Rather, I'm trying to nail down an interface to Poly1305 in the Crypto++ library. In effect, the question becomes how much leeway to allow a programmer when constructing one in Crypto++. – user10496 Apr 1 '15 at 8:26
• OK, so if you are going to allow this then a bit of a warning to your users would be nice. – Maarten Bodewes Apr 1 '15 at 20:42