# Increased AES key lengths vs keyphrase entropy

I'm selecting an AES key size for a LUKS partition using XTS-PLAIN64.

XTS will effectively reduce the AES key strength in half.

The default key size for AES XTS-PLAIN64 is 256 bits (meaning 128 bits effective). Given exponential progress making quantum computing ever more a reality, I was thinking to increase the key size.

I believe that AES is only defined on key sizes of 128, 192 and 256 bits, but cryptsetup/LUKS does allow me to select a key size of 384 or 512 bits.

I am aware that in theoretical related-key attacks certain cases AES256 may be less secure than AES192, but I'm not going to be using related keys.

1. What are the implications of using a 384- or 512-bit AES key?

2. Even if using XTS with AES256 (128 bit effective strength), would my 90-bit entropy keyphrase and 15,000 PBKDF2 iterations of SHA-512 still be the weakest link in the chain?

3. How would I work out how many bits of entropy and iterations are needed to make the keyphrase and the AES128 encryption the equal-weakest links in the chain?

If you could answer using finger-puppets in preference to complex formulae (where possible), that would be appreciated - I'm relatively new to the world of crypto.

I believe that AES is only defined on key sizes of 128, 192 and 256 bits, but cryptsetup/LUKS does allow me to select a key size of 384 or 512 bits.

AES itself is only defined for 128, 192 and 256 bits keysize.

However, XTS involves two instances of AES which can (and should) be keyed independently, meaning XTS-AES-256 really is 2 instances of AES-128 and 384 is two instances of AES-192 and 512 is two instances of AES-256.

Even if using XTS with AES256 (128 bit effective strength), would my 90-bit entropy keyphrase and 15,000 PBKDF2 iterations of SHA-512 still be the weakest link in the chain?

A break of AES by a quantum computer is stil decades away given the current state of quantum computers. Honestly I wouldn't worry about it if I'd need to worry about secrecy for less than say 50 years.

And yes your 90-bit-entropy passphrase will still be the weakest link. After all to brute-force that password, one would need about $2^{104}$ SHA-512 evaluations which is still much faster than even the "weak" $2^{128}$ AES evaluations. To get a comparable security level you either need to pick a (longer) passphrase or increase the iteration count by about $2^{20}$ which is about a million, meaning you'd be looking at 15 billion iterations which will take a lot of time to the point where it won't be acceptable to wait.

How would I work out how many bits of entropy and iterations are needed to make the keyphrase and the AES128 encryption the equal-weakest links in the chain?

To brute-force an $n$-bit key, you need about $2^n$ operations. To brute force a password with $k$ bits of entropy you need about $2^k$ operations and you can slow this down by a factor of $t$ which is the iteration count (in this case, you can also use more memory which will make attacks more expensive). So what you want, is:

$$\log_2(t) + k=n$$

• If I understand correctly 256-bit keys for XTS mean 128-bits keys for AES. The rule of thumb is that a quantum computer would halve the key size for symmetric ciphers. So shouldn't the calculation be with $2^64$ meaning the passphrase would actually not be the weakest link anymore? – Elias Oct 27 '16 at 14:33
• @Elias no, with XTS-AES we get at least 256-bit baseline security (meaning 128-bit security against quantum computers). – SEJPM Oct 27 '16 at 17:39
• Am I right that $2^{104}$ is $2^{90} \times (approximately) 2^{14}$ iterations ? Also, aren't you assuming that a PBKDF2 SHA-512 operation takes the same time as a AES-$k$ key attempt? (I don't know, is this roughly the case?) – Tom Hale Oct 28 '16 at 2:21
• With XTS-AES-128, would you use 256 as the value of $n$? Also, using $t = 15,000$ iterations, and $k = 90$ bits of password entropy, I get $n$ being 1248... but AES-1248 doesn't sound right... what am I doing wrong? – Tom Hale Oct 28 '16 at 2:45
• @TomHale I screwed up. The formula is fixed now.and yes the 104=90+14. And yes with these orders of magnitude we are talking about, the speed difference between AES and SHA is negligible. And the last equality shouldn't be taken literally but rather as a guideline. – SEJPM Oct 28 '16 at 8:45