# Replacing a block cipher's key schedule with a stream cipher

Take Rijndael (AES) of block size 128 and reformulate it with a tweakable number of rounds and no key schedule.

Suppose we obtain:

Rijndael128(r, k)


where r is number of rounds and k is key of length r*128 bits (it is the concatenation of all round keys).

k is then made salsa20(x) where x is a 256 bit secret and nonce is constant.

Would this be at least as secure as AES-256 when r >= 14? Assume no timing or side channels.

• It would most likely be more secure, the AES key schedule is substantially more linear than Salsa – Richie Frame Jan 4 '18 at 22:50