Rijndael could support block sizes up to 256 bits; this seems to be useful in AEAD. Wht did NIST restrict AES to a 128-bit block size?

  • 2
    $\begingroup$ 128 bits was a reasonable block size in 1997, when the AES competition was announced. (Remember, AEAD didn't even exist at that point.) Allowing for an two block sizes in the final approved configuration would have required twice the analysis required for a given confidence level, and there was no practical need at the time. $\endgroup$ – Xander Feb 17 '16 at 20:56