1
$\begingroup$

Why are AES keys increments of 64-bits? Rijndael, which subsequently became AES, allowed key increments in 32-bits (128, 160, 192, 224, and 256 bits). However, AES made it 128, 192, or 256.

My guess would be that a 64-bit default increment may be good to increase the lifetime of a particular key size for a particular application. For example, assume that an application is using 128-bits and then the application owners feel they have to increase key size because of threats. An increase to 192-bits (cf. 160-bits) may give this upgrade a longer life before technology advancement catches up and the application owners have to change again. Is this speculation in the right direction?

Improve this question
$\endgroup$
  • 4
    $\begingroup$ In hindsight, the 192 bit key size was probably a mistake. 192 is not a multiple of 128, which makes things like key wrapping a tricky thing to do. Kudo's though for at least restricting the amount of choices, like they did not do for e.g. KDF's, which are a frickin' mess. When it comes to standardization the limiting of choices is almost a goal in itself. Less testing, more compatible implementations... $\endgroup$ – Maarten Bodewes♦ Jan 21 '20 at 17:59
2
$\begingroup$

When NIST made the call for AES, they were trying to address short comings of DES that had a 56-bit key (64-bits with parity). I got the following information from NIST while at the NIST 8114 conferences because I was complaining about having to keep 192-bit key compatibility in my SIMON hardware when no one would likely use it.

The summary:

In 1997, the idea was to double the key length (to 128-bits) and then double the key length again (to 256-bits). The reason that 192 bits was there was because it was thought that an intermediate key length would be good for systems that couldn't handle the complete 256-bit length. You need to keep in mind that at the time of specifying 128/192/256 bits, and algorithm had not yet been picked. On 1997 hardware, 192-bits takes more time than 256-bits, and it was hoped that by having a larger key size the life of AES would be more than 20-years, unlike DES.

As mentioned in the comments, retrospectively, the 192-bit requirement was likely not optimal as pretty much no one uses it. You have to include a 192-bit key option in your hardware cores for complete AES compatibility. I had a bug in my netlist verification for AES-192 for 10 years, and I only found it recently, which really means... no one every uses AES-192.

Improve this answer
$\endgroup$
  • 1
    $\begingroup$ As an aside, I have one user of SIMON128/192, and this is only because the fast clock on their RF system is not fast enough to do SIMON128/256. $\endgroup$ – b degnan Jan 23 '20 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.