# Choice between AES-128 and AES-256 for password protection in MS Office

Why are we still using the default of AES-128 when password protecting a Microsoft Word document. My answer is and always has been - because its good enough and MS don't recommend changing to AES-256. However, that has got me thinking: if a user password protects their word document (.doc, .docx) with a 10 character password of P@ssw0rd10 using the default AES-128 encryption, is that a harder password to crack than an 8 character password of P@ssw0rd using AES-256?

What is it a brute force attack is trying to achieve. Crack the AES-128/-256 algorithm which then in turn reveals the password? Does password length and character selection actually matter (you can input a password of up to 255 characters on a word doc) or is it the AES type in use that matters?

• Direct guess of AES keys (of 128 or 256 bits) is not the weak spot in either method. The question revolves around nature and parametrization of the password entropy stretching used by (an unspecified breed of) Microsoft Office/Word to transform the password into key for the two methods; and if there is a backdoor (deliberate or accidental). Unless you add description of that (or a link), this is off-topic, being specialized to a particular commercial line of programs. What about generalizing to password-based encryption with entropy stretching?
– fgrieu
Mar 17, 2017 at 13:43
• I agree with fgrieu that this question could really be helped by making it more general. I would also recommend removing any potentially personally identifying information (employer and job title). Mar 17, 2017 at 13:54
• If I get a chance, I'll add a comment with a suggested wording for the question. Just don't have time right now. If anyone else has an opportunity to make a suggestion for wording on how this could be generalized yet still provide the OP with the information they need, that would be awesome. Mar 17, 2017 at 13:56
• Mar 17, 2017 at 14:04

A cryptosystem is as strong as its weakest link. AES-128 is almost certainly not the weakest link in your system. Therefore, strengthening it by increasing the key length will not make the overall system more secure in practice.

To expand on that, let's consider (some of) the possible attacks on your system:

1. The attacker finds the user's password written on a post-it note.

2. The attacker sneaks a keylogger onto the user's computer and captures the password as the user types it in.

3. The attacker tests common passwords and their variations (e.g. "password" → "P@ssw0rd") until they find the correct one.

4. The attacker tests all the possible 128-bit AES keys derived from the password until they find the correct one.

5. The attacker finds a bug in the MS Office implementation of AES encryption that allows them to bypass it without knowing the correct password or key.

6. A cryptanalytic break of the AES algorithm renders it significantly easier to decrypt than by brute force testing all the keys.

Switching from AES-128 to AES-256 directly affects only one of these attacks: the brute force AES key enumeration attack (#4 above). Even for AES-128, this particular attack is already considered practically impossible even for large nation states. Switching to a 256 bit keyspace just moves it from "practically impossible using current or near future technology" to "completely unimaginable using any technology we can currently foresee".¹

That still leaves potential attacks 1, 2, 3, 5 and 6. Attack #6 (a cryptanalytic break of AES) is not really something an end user should be worried about. While such a break theoretically could compromise AES-128 while still leaving AES-256 with enough security margin to resist practical attacks, the opposite is theoretically possible as well.² In any case, a cryptanalytic break on AES itself is a far less likely scenario than a vulnerability in the way a particular commercial software product uses it (attack #5 above).

In any case, the most likely practical threats to your system are attacks 1–3 above, or other similar attacks aimed at compromising the user's password rather than the encryption key derived from it.

While attack #3 can somewhat be mitigated by key stretching (if MS Office uses it, which I don't know), even the best (and slowest) key stretching algorithms can only slow down brute force password cracking by a factor of 230 to 240 or so; i.e. they add at most 30 to 40 bits of effective strength to the password. Thus, unless your users use passwords with about 90 or more bits of entropy (as provided e.g. by a 7 word diceware passphrase) and unless the software you're using uses proper key stretching with the highest feasible memory usage and iteration counts, brute forcing the password (attack #3) will always be easier than brute forcing even a 128-bit key (attack #4).

And even then, that still leaves attacks 1 and 2, and any other methods (such as "rubber hose cryptanalysis") of extracting the password from the user or their computer. Those are the threats that you really should be concerned about.

1) In particular, practical large-scale general purpose quantum computers could theoretically break AES-128 about as easily as conventional computers with a similar clock speed could break DES. So far, the actual quantum computers that have been built aren't anywhere close to being able to do anything cryptographically useful, but it's always possible that there could be some kind of a massive quantum computing breakthrough within our lifetimes. For whatever it's worth, that's currently the best argument I know of for switching to 256-bit keys. Of course, such a quantum computing revolution would also totally destroy all public-key crypto algorithms in common use today.

2) Indeed, some currently known related key attacks on AES are more effective against AES-256 due to differences in its key schedule. Fortunately, such attacks require a very specific combination of circumstances, and are not possible if the AES keys are derived using a proper key derivation function.