# How does AES bit security increase by round?

As AES progresses through multiple rounds, approximately how does it security increase round by round up to its maximum? I'm curious about the shape of the curve. Is it linear, some kind of exponential, a power law curve, etc.?

• Did you check the linear and differential attack costs? Mar 23 at 21:07
• Mar 23 at 21:32

A few data points for AES-128. In 2018 Bar-On, Dunkelman, Keller, Ronan and Shamir described a 32-bit attack on 5 round AES (attack complexity here is the maximum of data, memory and computation requirements) and claimed a 99-bit attack on 7 round AES. The 2011 biclique cryptanalysis paper of Bogdanov, Khovratovich and Rechberger claims a 125.4-bit attack on 8 rounds and a 126.18-bit attack on 10 rounds. I'll claim a 128-bit attack against 11 rounds :-)

Based on our current knowledge then, perhaps it looks like an S-curve? Of course cryptanalytic effort has focussed strongly on larger numbers of rounds and I'd be hesitant to hypothesise any security vs. rounds function based on this.

ETA: The quoted figures for 8 and 10 rounds were for a related key biclique attack. The current best generic attack for 10 rounds is $$2^{126.01}$$

• S curvy perhaps for attack complexity vs rounds, but the question is strength vs rounds. So your s-curve needs to be inverted, or plotted as (128 - attack complexity) vs rounds. I.e.asymptotic to zero. Mar 24 at 11:23
• Although you have answered my referenced question :-) Mar 24 at 11:30
• What about small numbers of rounds? e.g. 1-4 rounds? My impression is that one round is pretty trivial to break. Otherwise it does look like a sort of S curve where things get good around 5 rounds and diminishing returns kick in after 8-9 rounds. Mar 24 at 17:43
• The 2011 biclique cryptanalysis is a related key attack that has no place for encryption since we are expected to choose uniform random keys. It is related to consructing hash functions from any block cipher. The 2018 article is the full round attack Mar 24 at 18:25
• Thanks @kelalaka ! Before I edit to update the 10 round estimate, do you know if the biclique crowd had an estimate for 8-9 rounds in the non-related key setting? Mar 24 at 18:33