4
$\begingroup$

In his blog Schneier discusses that there is a new related key attack on 10 rounds of AES-256 "Another attack can break a 10 round version of AES-256 in 245 time, but it uses a stronger type of related subkey attack".

My question is how many more rounds would they have to use to keep this security margin on AES (other then adding a hash to AES 256 key schedule)? And would NIST actually change the standard again to something more secure such as Serpent?

Consider the number of rounds broken out of the total rounds for the security margin.

$\endgroup$
  • $\begingroup$ "And would NIST actually change the standard again to something more secure such as Serpent?" - No they wouldn't. AES has been selected and won't be changed. If AES fails too hard it will be replaced by a new standard (AES2?). Note that while these attacks pose a threat to AES they require related keys which are extremely rare in practice and even then the cost for the attack is still too high. $\endgroup$ – SEJPM Nov 29 '15 at 19:28
  • $\begingroup$ What do you mean by "keep this security margin"? Do you mean ensure 128/256-bit security for AES-128/256? (BTW, NIST would probably "change the standard", since that's what they've done with the Secure Hash Standard. That's just semantics, though, the point of your second question is clear.) $\endgroup$ – otus Nov 30 '15 at 7:26
  • 1
    $\begingroup$ What I mean by keep the security margin is that "The attack only breaks 11 rounds of AES-256. Full AES-256 has 14 rounds." So the security margin of the remaining rounds are low. $\endgroup$ – PYZH Dec 1 '15 at 1:08
4
$\begingroup$

My question is how many more rounds would they have to use to keep this security margin on AES (other then adding a hash to AES 256 key schedule)?

When AES was standardized, the best known attack (pdf, page 19) in terms of rounds broken was a related key attack that broke 9/14 rounds of AES-256. The best attack on AES-128 broke 7/10 rounds.

Currently, the best attacks (pdf, paywall) are actually on full round variants. It's just that those attacks are only very slightly better than brute force. If you assume those attacks do not apply to increased-round variants, you would get the same security margin of unbroken rounds by defining AES-128 with 13 rounds and AES-256 with 19 – or maybe 14 and 20 for nicer numbers and in case an extra round can be broken with current attacks.

However, "rounds broken" is a rather crude measure. The best practical attack (in terms of computational cost) at the time of standardization was on six rounds for all variants. Now there are at least related-key attacks of practical complexity on 10/14 rounds of AES-256.

Either way, something like 14/20 rounds for AES-128/256 might be a reasonable number if the standard was revised, but attacks are still far from practical.

And would NIST actually change the standard again to something more secure such as Serpent?

I doubt they would just change it to another existing cipher. Serpent may have more of a security margin, but it has also seen less cryptanalysis at this point. More likely would be another competition for "AES-2", like the one for SHA-3. Existing ciphers might be submitted, of course, but new ciphers would also be considered.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.