I have a SoC with hardware AES128 encryption, which is obviously quite efficient in terms of power usage and memory used. However, we would like to have AES256 encryption (half for commercial reasons, half for post-quantum security). To achieve this, we consider:
Using software encryption (which will be slower, use more power, and at the least require more code and hence flash space).
Using 2 rounds of AES128 one on the other, with different keys, effectively giving us a key length of 256 bits.
I am aware that 2 round of 128 bits is not the same as 1 round of 256 bits, but as I'm not an expert, I was wondering if anyone knows about drawbacks or vulnerability introduced by such practice, and ultimately if this would be equivalent to the security brought by AES 256 (ie, take a similar amount of time to break the encryption).
Also, I use AES CTR. The planned implementation would be create 1st cypher block, XOR it with 2nd, and XOR this with the plain text.