If I have a AESX-192 be a block cipher which is similar to DESX but has the DES being replaced by AES and the AES key size is 192 bits.

How should I compute the total effective key length of the AESX-192.

  • 3
    $\begingroup$ @fgrieu: actually, the total number of permutations possible with AESX-192 does not immediately give the effective key strength, because it is possible to test multiple AESX-192 keys in sublinear time. $\endgroup$ – poncho Jan 31 '16 at 23:03
  • 1
    $\begingroup$ @poncho: indeed, my mistake. That makes the question more interesting. $\endgroup$ – fgrieu Feb 1 '16 at 4:57
  • 1
    $\begingroup$ Isn't it just a matter of replacing the block size and key size in the equation for DESX with the equivalents for AES-192? $\endgroup$ – otus Feb 1 '16 at 7:28

The security bound for this construction is (PDF, section 4.7.3 in v4) $$\mathbf{Adv}^{\text{sPRP}}_{\text{AESX-192}}(\mathcal A)\leq \frac{2Q_sQ_{AES}}{2^{192}\cdot 2^{128}}$$ to be a strong PRP assuming AES can be modeled as an ideal cipher (not perfectly accurate but probably "close enough" here), where $Q_s$ is the number of "online" queries against a keyed oracle of the cipher and $Q_{AES}$ is the total number of AES evaluations for this.

So for an off-line brute-force search you actually get a 384-bit security strength, for a "online" security it breaks after $2^{160}$ queries. Therefore it may be easier to "just" use normal AES-192...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.