# total effective key length of the AESX-192

If I have a AESX-192 be a block cipher which is similar to DESX but has the DES being replaced by AES and the AES key size is 192 bits.

How should I compute the total effective key length of the AESX-192.

• @fgrieu: actually, the total number of permutations possible with AESX-192 does not immediately give the effective key strength, because it is possible to test multiple AESX-192 keys in sublinear time. – poncho Jan 31 '16 at 23:03
• @poncho: indeed, my mistake. That makes the question more interesting. – fgrieu Feb 1 '16 at 4:57
• Isn't it just a matter of replacing the block size and key size in the equation for DESX with the equivalents for AES-192? – otus Feb 1 '16 at 7:28

The security bound for this construction is (PDF, section 4.7.3 in v4) $$\mathbf{Adv}^{\text{sPRP}}_{\text{AESX-192}}(\mathcal A)\leq \frac{2Q_sQ_{AES}}{2^{192}\cdot 2^{128}}$$ to be a strong PRP assuming AES can be modeled as an ideal cipher (not perfectly accurate but probably "close enough" here), where $$Q_s$$ is the number of "online" queries against a keyed oracle of the cipher and $$Q_{AES}$$ is the total number of AES evaluations for this.
So for an off-line brute-force search you actually get a 384-bit security strength, for a "online" security it breaks after $$2^{160}$$ queries. Therefore it may be easier to "just" use normal AES-192...