I'm selecting an AES key size for a LUKS partition using XTS-PLAIN64.
XTS will effectively reduce the AES key strength in half.
The default key size for AES XTS-PLAIN64 is 256 bits (meaning 128 bits effective). Given exponential progress making quantum computing ever more a reality, I was thinking to increase the key size.
I believe that AES is only defined on key sizes of 128, 192 and 256 bits, but cryptsetup/LUKS does allow me to select a key size of 384 or 512 bits.
I am aware that in theoretical related-key attacks certain cases AES256 may be less secure than AES192, but I'm not going to be using related keys.
What are the implications of using a 384- or 512-bit AES key?
Even if using XTS with AES256 (128 bit effective strength), would my 90-bit entropy keyphrase and 15,000 PBKDF2 iterations of SHA-512 still be the weakest link in the chain?
How would I work out how many bits of entropy and iterations are needed to make the keyphrase and the AES128 encryption the equal-weakest links in the chain?
If you could answer using finger-puppets in preference to complex formulae (where possible), that would be appreciated - I'm relatively new to the world of crypto.