Some cryptographic libraries (like “Bouncy Castle”) support many modes where the maximum number of bits which can be produced by the hash are significantly fewer than the cipher strength. For example:

  • MD5 (128 bit max) is paired with 256 Bit AES
  • SHA1 (160 bit) max is paired with 256 Bit AES

What benefit is derived from using 256 bit AES over 128 Bit AES in cases like this?

  • $\begingroup$ Both of those are old, weaker hash functions. They're not recommended for use in new systems. So the primary benefit is probably just to support legacy systems that don't have SHA-2 (256) or newer capability. AES tends to be supported in all 3 of its variants, so anything supporting SHA1 + AES will support SHA1 + AES 128, 192, and 256, even when there's no practical benefit to using anything other than AES 128. $\endgroup$ Aug 7, 2015 at 2:09
  • $\begingroup$ Could you point out where this is used? Are we talking about TLS cipher suites here? $\endgroup$
    – Maarten Bodewes
    Aug 7, 2015 at 8:36

1 Answer 1


Well, firstly, SHA-1 still seems to have 160-bit preimage and second preimage resistance, so using it in HMAC requires more than 128-bit AES keys to get equivalent security.

AES 192 would be sufficient, but isn't used in e.g. TLS – RFC 3268 says:

The AES supports key lengths of 128, 192 and 256 bits. However, this document only defines ciphersuites for 128- and 256-bit keys. This is to avoid unnecessary proliferation of ciphersuites.

So with AES and SHA-1, you can pick between either MAC security (AES-256) or cipher security (AES-128) being the limiting factor.

As for MD5, there are no TLS cipher suites with AES + MD5 at all. In the case of password-based encryption, where a combination of MD5 and AES-256 is defined in Bouncy Castle, it's definitely a legacy algorithm.

In general, there's a difference between the integrity offered by the MAC (which the hash functions are used for here) and the privacy offered by the cipher. If you valued privacy above integrity, you could have a higher minimum security you desire from the cipher. An attack on the MAC would frequently have to be online, while an attack on the cipher could be done offline, even years after the fact.

Also, the MAC length requires space in each message, while the key length of AES does not, so you might want to use a short MAC even if you were fine with long keys and the resulting processing time.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.