13
$\begingroup$

I have been trying to find a case where AES-192 is used over AES-128 but AES-256 is not used. There are many questions about AES here (I liked this one AES-128/192/256), but from the actual application side, I was unable to determine any cases where AES-192 was used over AES-128.

AES-192 seems to exist because levels of security were desired, but hardware implementations seem to be AES-128 or AES-256. I did a literature survey on the IEEE and I couldn't find any applications in the hardware space that used AES-192 instead of AES-256, and I could not find anything in the software space, but I did not dive into specific implementations.

Is there any compelling or logical reason to use AES-192 over AES-128 but not use AES-256?

Maybe you can even point me to an example – meaning: some application or implementation where AES-192 is used over AES-128 instead of AES-256?

Improve this question
$\endgroup$
6
  • 3
    $\begingroup$ AES-192 should be about 16% faster than AES-256. $\endgroup$
    – CodesInChaos
    Feb 1, 2017 at 16:59
  • $\begingroup$ @CodesInChaos if you care about speed you'd use AES-128 and if you want to impress your customers you'd invest those 16% to get the "fancy" 256-bit encryption. That said, if you care about speed and those nasty multi-target attacks that might serve you as an excuse. $\endgroup$
    – SEJPM
    Feb 2, 2017 at 9:58
  • 2
    $\begingroup$ @CodesInChaos Just some trivia, I don't used clocked circuits, so due to the 20% mismatch in thresholds at small nodes, the actual implementations are the same for speed. Every circuit is different due to manufacturing, but the power is roughly consistent: AES192 is 1.8 times more power hungry than AES128, and AES256 is 1.5 times more power hungry than AES192. (these are simulation numbers based on my Monte Carlo results, I'm about to make something, which is the inspiration for the question) $\endgroup$
    – b degnan
    Feb 2, 2017 at 14:02
  • $\begingroup$ @bdegnan Is there any chance your project will be open to viewing/collaboration? clock-less circuits sound cool and I wouldn't mind picking your brain about EE in general... $\endgroup$
    – Ella Rose
    Feb 2, 2017 at 17:54
  • 1
    $\begingroup$ @EllaRose As an academic, everything I do is open as far as architecture and circuits. I only cannot show the physical implementations and the specific processes outside of saying things like "a commercial 14nm process". $\endgroup$
    – b degnan
    Feb 2, 2017 at 18:17

2 Answers 2

Reset to default
10
$\begingroup$

There is no reason to use a AES-192 if you have access to AES-256 (or AES-128).

This question is completely in line with the following thread:
[Cfrg] A little room for AES-192 in TLS? which resulted in this somewhat conclusion:

Dear all,

the related-key attacks against AES were interesting from an academic point of view as they broke the security claim we made for Rijndael.

However, the attacks require very sophisticated manipulations of the secret key by the attacker. For example, even a protocol that would allow an attacker to add (or XOR) a value of her choice to the key before being used in AES would not allow mounting the attack. If you are interested, you can read the paper Vincent and I wrote "On the related-key attacks against AES" available at e.g. http://jda.noekeon.org/

As for including AES-192 in TLS, I don't see any benefits.

Kind regards,

Joan Daemen

TL;DR: To sum up the only real advantage of AES-192 is the insignificant gain of speed compared to AES-256.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Biv, do you have any idea why there this quote "Seeing that we live in "a world of 2^50 keys"" in the link that you included? $\endgroup$
    – b degnan
    Feb 2, 2017 at 17:44
  • $\begingroup$ It is explained a bit later: "Well, assuming Shor and/or Grover half the effective strength of symmetric ciphers and these related key attacks were to be practical the effectiveness of AES-256 would fall below 2^50 against ~ 2^89 for AES-192." by the same author. (that would be my assumption). $\endgroup$
    – Biv
    Feb 2, 2017 at 17:46
4
$\begingroup$

Speaking formally:

Speaking realistically:

  • Related key attack requires several unrealistic assumptions (access to plaintext.
  • It breaks 11 rounds of AES-256 out of 14, so attacker will still need to brute the rest.

However, cryptographers frequently think about theoretical security, and, yes, there are cases where AES-256 is weaker in regard to some attacks than AES-192. Which isn't something I'd worry about, and, if performance is not a question, just double the number of rounds.

Improve this answer
$\endgroup$
1
  • 11
    $\begingroup$ "access to plaintext" is a realistic standard assumption. The unrealistic assumption are the related keys, because well defined protocols never use those. $\endgroup$
    – CodesInChaos
    Feb 2, 2017 at 10:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.