What is the difference between key size and block size (for AES)?

Question

We are working on AES and want to develop a website which should provide an encryption facility but we are not understanding the difference between key and the block size. More appropriately what does a 128, 192 and 256 bit key mean?

Answer 1

The key size is simply the amount of bits in the key. With AES, like most modern block ciphers, the key size directly relates to the strength of the key / algorithm. The higher the stronger. Since all bits are used, there are $2^{\mathit{klen}}$ possible keys, taking $2^{\frac{\mathit{klen}}{2}}$ operations to brute force on average.

For AES the internal key schedule and the number of rounds are different for each key size. Due to the difference in key schedule there are related key attacks on AES-256 but not on AES-128 or AES-192. The number of rounds is 10, 12 or 14 for the 128, 192 and 256 bit key size respectively. The overall algorithm behind the AES cipher remains the same.

---

The block size is simply the amount of bits or bytes that can be transformed by the block cipher. It is the input and output size of the keyed block cipher. This transformation is called a keyed permutation as each plaintext has a corresponding ciphertext (and vice versa) for a specific key. For AES the block size is 128 bits or 16 bytes. So a plaintext from the set of $2^{128}$ possible plaintext is permuted to a single ciphertext from the set of $2^{128}$ possible ciphertext.

It is also a pseudo-random permutation or PRP as there is no link between the plaintext and the ciphertext. To be more precise the ciphertext block is indistinguishable from random as long as the key is unknown to any observer. Of course it is only pseudo random as the same plaintext will always permute to the same ciphertext, as long as the key doesn't change.

---

The number of permutations of a block cipher (i.e. all the possible ways that plaintext blocks can be mapped 1:1 to the ciphertext blocks) rises much faster per bit of the block size than the amount of keys per bit specifying the key size. With a block size of 128 bits the key size can grow to unreasonable sizes without having to worry about duplicate permutations.

---

Notes

• the key size and block size are not directly related to each other - it is possible to create a block cipher for any key size and block size;
• AES is a subset of Rijndael, which is the winner of the AES contest by NIST. Rijndael allows key and block sizes of 128, 160, 192, 224, and 256 bits (32 bit increments);
• a block cipher is not a generic cipher, a mode of operation is required to use the block cipher to protect confidentiality;
• although the block size is not directly related to the security of the block cipher itself, it does affect the security of the mode of operation that the block cipher is used in;
• the related key attacks on AES-256 are only of influence if a large number of related keys are generated, for instance when AES is used to create a secure hash function - the use of AES-256 remains secure when used for a particular mode of operation to obtain confidentiality or within a MAC to obtain message authentication and integrity;
• AES-256 can be used to provide protection against analysis of the block cipher with a (fully functional, large state) quantum computer - AES-128 provided plenty of protection against the currently known attacks without QC;
• AES-192 doesn't make too much sense as it is not as fast as AES-128 while not providing the very large key size of AES-256 to provide the highest security strength or full protection against QC;
• AES-192 is tricky to use because the key size is not a multiple of the block size, this makes it hard to use AES-192 in protocols where keys need to be encrypted or when the output of the cipher needs to be used as key.