# On AES, is a true random string enough for a key?

The string (32 ASCII characters) is entered by a human, and considered truly random. Should a key derive from this string, or it is secure to use this string as a key directly? In other words, does deriving a key from this string makes the encryption more secure?

• Of course a true random string is a good key - actually, you can't do better. But your question is really asking whether a 32-character printable ASCII random string is a good key. – user253751 Dec 13 '15 at 23:48

Even if the 32 characters are completely random, they won't contain non-printable characters. Actually, there are only about 107 printable characters in ASCII (out of 256 values for a full byte) and that even includes the space character. So if all the printable characters are used, it would result to a security level of about $log_2(107^{32}) = 215$ bits, which is quite a lot.

AES reaches the highest level of security for random keys, so in general it is better to put the value through a KDF (Key Derivation Function) together with a salt, possibly a label (OtherInfo) to derive a specific key and possibly - for a Password Based Key Derivation Function such as PBKDF2 or Argon2 - a work factor. That way the security of the key may get closer to the 256 bit strength that e.g. AES-256 promises.

So yes, deriving a key would be more secure. Doubly so since your first sentence "The string (32 ASCII characters) is entered by a human, and considered truly random" is usually not correct in practice. Humans are horrible with regards to entering truly random numbers, even if just because of the typo's when entering it from another screen.

• Are the proofs for AES's security dependent on the key being random, or merely on the entropy content of the key? – Cort Ammon Dec 14 '15 at 0:17
• From the Rijndael paper, chapter 7.5: The key expansion specifies the derivation of the Round Keys in terms of the Cipher Key. Its function is to provide resistance against the following types of attack: • Attacks in which part of the Cipher Key is known to the cryptanalyst; ... You should however note that the subkey derivation is not super secure and that for AES-256 related key attacks have been found. But yes, according to the design entropy should be enough... so you are allowed to shoot yourself in the foot :) – Maarten Bodewes Dec 14 '15 at 19:21

AES can have key lengths of 128, 192 and 256 bits. ASCII characters are usually stored in bytes, each byte having 8 bits. But strictly speaking, ASCII only has 7 bits. Thus, concatenating the yields a number consisting of 224 bits or 256 bits. But only 224 bits is not a valid length for an AES key.

Since the characters will be entered by a human, that implies that only printable characters will be entered. ASCII characters such as form feed, carriage return, and back space will be excluded. Thus, the 256 bits will not be as fully random as they could be. Deriving a key from 32 random printable ASCII characters with an appropriate algorithm should yield a random key of 128 bits. More research should be done if you want a 192 bit random number, or if the characters the human can enter come from a more restricted set, such as the characters that appear on the standard keyboard of a certain country.