5
$\begingroup$

I have a SoC with hardware AES-128 encryption, which is obviously quite efficient in terms of power usage and memory used. However, we would like to have AES-256 encryption (half for commercial reasons, half for post-quantum security). To achieve this, we consider:

  • Using software encryption (which will be slower, use more power, and at the least require more code and hence flash space).

  • Using 2 rounds of AES-128 one on the other, with different keys, effectively giving us a key length of 256 bits.

I am aware that 2 round of 128 bits is not the same as 1 round of 256 bits, but as I'm not an expert, I was wondering if anyone knows about drawbacks or vulnerability introduced by such practice, and ultimately if this would be equivalent to the security brought by AES-256 (ie, take a similar amount of time to break the encryption).

Also, I use AES CTR. The planned implementation would be create 1st cypher block, XOR it with 2nd, and XOR this with the plain text.

Improve this question
$\endgroup$
4
  • 1
    $\begingroup$ It suffers from a meet-in-the-middle attack. Read up on why we used 3DES instead of 2DES. Though if Bernstein is right quantum computers might not speed meet-in-the-middle attacks, so you'd still get 128 bits of security against QCs (If he's wrong, you get 85 bits). $\endgroup$
    – CodesInChaos
    Jun 5, 2017 at 8:17
  • $\begingroup$ Xor in that case might be a safe combiner and not affected by meet in the middle. $\endgroup$
    – eckes
    Jun 5, 2017 at 9:16
  • 1
    $\begingroup$ @eckes: actually, xor would most certainly be subject to MitM attacks. On the other hand, as any such attack would involve $2^{128}$ operations, it really is not of practical interest... $\endgroup$
    – poncho
    Jun 5, 2017 at 13:41
  • $\begingroup$ Hm, I said it is not vulnerable since it is a secure combiner. $\endgroup$
    – eckes
    Jun 5, 2017 at 16:35

1 Answer 1

Reset to default
7
$\begingroup$

Double encryption with 128-bit AES and two different keys does not give 256-bit security. In particular, a classic Meet-in-the-Middle attack applies, with expected cost $2^{128}$ encryptions and $2^{127}$ decryptions. As is, the attack requires ridiculously large amounts of memory, but improvements (using cycle finding with distinguished points) exist that greatly reduce memory requirement. See section 5.3 on MitM in Paul C. van Oorschot and Michael J. Wiener: Parallel Collision Search with Cryptanalytic Applications (in Journal of Cryptology, January 1999, Volume 12, Issue 1).

I find it likely that a system has weaker points than AES-128's key size; systems may be vulnerable against key compromise or side-channel attacks for example.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.