I have a SoC with hardware AES-128 encryption, which is obviously quite efficient in terms of power usage and memory used. However, we would like to have AES-256 encryption (half for commercial reasons, half for post-quantum security). To achieve this, we consider:
Using software encryption (which will be slower, use more power, and at the least require more code and hence flash space).
Using 2 rounds of AES-128 one on the other, with different keys, effectively giving us a key length of 256 bits.
I am aware that 2 round of 128 bits is not the same as 1 round of 256 bits, but as I'm not an expert, I was wondering if anyone knows about drawbacks or vulnerability introduced by such practice, and ultimately if this would be equivalent to the security brought by AES-256 (ie, take a similar amount of time to break the encryption).
Also, I use AES CTR. The planned implementation would be create 1st cypher block, XOR it with 2nd, and XOR this with the plain text.