# What are the advantages of AES-128 cascade vs AES-256?

Ok so let's say I have some top secret data ~ 50-100 MB and I need it to be protected. The cipher operation mode and the KDF is irrelevant for this example. Let's just assume we use gpg.

The only possibility is either single AES-256 encryption, so 14 rounds with a 256 bit key size or dual AES-128 x2 (cascade) with 20 rounds and an effective key size of 256 bit.

The AES-256 would be 140% slower, while the AES-128 cascade would be 200% slower when measured against AES-128.

So which of the 2 should I take and why?

Is the effective key size of 2 x 128 bit really as strong (or even stronger) than the 256 bits of AES-256?

• You can run a meet-in-the-middle attack against the double encryption giving your $2^{129}$ time complexity (and $2^{128}$ storage complexity). – SEJPM Jul 18 '17 at 16:04

Using double encryption is always attackable with a Meet in the middle attack which reduces the effective strength to $2\cdot 2^{128}$ (in your case), but requires a lot of memory ($2^{128}$ blocks must be stored).

This is the very reason, why one uses a triple-encryption scheme to strengthen DES to 3DES via the EDE construction.

Besides: you have a standardised scheme which has been proven to be secure and works on 256-bit keys. There is absolutely no reason to make your life more complicated and insecure by trying homegrown constructions.

• Even 3DES is vulnerable to a meet in the middle attack, just not as bad as it could be. – forest Dec 15 '17 at 6:06

I can only see one advantage, and in this case the mode does matter. You have your keys $K1$ and $K2$, and your 2 ciphers, $E_{K1}$ and $E_{K2}$. Using 2 ciphers in a cascade allows you to do this:

$A$ = $E_{K1}$( $n$ $||$ $i$ )

$B$ = $E_{K2}$( $A$ $\oplus$ $P_i$ )

$C$ = $B$ $\oplus$ $A$

Where $P$ is the plaintext block, $n$ is a nonce, and $i$ is a block counter matching the index of $P$. This mode is an XEX type, it is fully parallel and seekable like ECB and CTR for both encryption and decryption.