Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Take Rijndael (AES) of block size 128 and reformulate it with a tweakable number of rounds and no key schedule.
Suppose we obtain:
Rijndael128(r, k)
where r is number of rounds and k is key of length r*128 bits (it is the concatenation of all round keys).
k is then made salsa20(x) where x is a 256 bit secret and nonce is constant.
Would this be at least as secure as AES-256 when r >= 14? Assume no timing or side channels.
The requirements of a key schedule would be easily met by Salsa20, or any PRF for that matter. A key schedule is similar in purpose to a cryptographic hash functions (which Salsa20 is built off of), but the requirements are not as strict. For example, a preimage attack is fatal to a hash function, but being able to calculate the original key given only the round keys is not a huge deal for a key schedule. For this reason, key schedules typically do not involve particularly computationally-intensive operations and instead opt for much simpler and more lightweight algorithms.
From a paper referenced by the answer linked above, there are several classifications of key schedules. A Salsa20-based key schedule would fall under category 2B, the strongest practical category. That is, every bit in the master key influences every bit in every round key. Changing any one bit in the master key will change, on average, 50% of bits in all the expanded round keys.
