1
$\begingroup$

Is this encryption method sensitive to weak keys? Is there any reference in the NIST on the AES key's entropy? (For example, must it have been generated from a TRNG?)

Can I safely use the Microsoft CAPI for key generation? (pseudorandom number generation)

Am I required to use true random number generation?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

AES doesn't require uniformly distributed keys. However, if you have a key with less than 256 bits of entropy, then naturally your keyspace will be smaller than the maximum. Whether or not this is an issue depends on just how few bits you have. The only time a non-random key is bad for AES is when it's chosen very specifically to be harmful, in which case it can be used for a related key attack.

If your input is not uniformly distributed though, the standard technique is to pass it through a hash function like SHA-256 first, which compresses it to 256 uniformly-distributed bits. Or use a KDF.

Improve this answer
$\endgroup$
9
  • $\begingroup$ so prng is good enough without KDF? $\endgroup$
    – Offir
    Jul 30, 2019 at 10:08
  • $\begingroup$ is there any need for TRNG based key? $\endgroup$
    – Offir
    Jul 30, 2019 at 10:08
  • 3
    $\begingroup$ A non-cryptographic PRNG is not good enough. As any documentation will tell you, use a CSPRNG. $\endgroup$
    – tylo
    Jul 30, 2019 at 11:58
  • 1
    $\begingroup$ @EllaRose What I meant is that, if you use a non-uniform key with, say, 100 bits of entropy for 256-bit AES, you won't be getting under 100 bits of effective keyspace. Naturally if you give it a key so bad that it only has 30 bits of entropy, then your key is too weak in the first place, regardless of whether you use a KDF. $\endgroup$
    – forest ♦
    Jul 31, 2019 at 4:52
  • 1
    $\begingroup$ @EllaRose In particular, the attack Squeamish Ossifrage mentions is the well-known related key attack against AES256 and AES192, which require very carefully chosen keys. You aren't going to find a related pair of keys by accident. I'm not sure why they chose to state in bold that you shouldn't "expect security". $\endgroup$
    – forest ♦
    Aug 3, 2019 at 8:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.