Let's say I have 128-bit cipher in which each round needs to get 768 key bits. Let's consider 10 rounds.

It can be easily 128-bit key cipher. I can do key schedule and produce 7680 bits of keys (let's say with HKDF). But I can also use for example 512-bit key. Then I still need key schedule, but the main key is stronger. And cipher still works on the same 128-bit blocks with the same speed (because it is using still 768 key bits in every round).

Will only by increasing the size of the main key from which I create the round keys I make the algorithm more secure? It is harder to broke main key in this case, but rounds remains the same weak (attacker still have to broke just 768-bit in every round). So maybe we should say that it make stronger key schedule only, not actual cipher? Is it make sense to increase the main key size in that case?

  • $\begingroup$ In differential and linear attack, if the last round attackable, it doesn't change how many rounds or original key you use. $\endgroup$
    – kelalaka
    Apr 28, 2021 at 9:39

1 Answer 1


Generally speaking, more than 128 bit security is not required - except maybe for protection against multi-target attacks where large amounts of ciphertext become available to the adversary. The reason for this is that no system will be able to perform $2^{128}$ operations. So if there is an analysis that threatens the structure or number of rounds used, then increasing the rounds or updating the algorithm will likely strengthen the security of the cipher more than increasing the key size.

Quantum computers are not really an exception to this but because of how they work, they often have a different value for the security in the first place. So for a block cipher you can generally assume that Grover's algorithm reduces the security for quantum computers to 64 bits. For this you'd need a full fledged quantum computer with enough qubits and error correction, not the expensive toys we have now.

Still, that means that upgrading to 256 bit security may be a good idea, so that 128 bits of security is restored when considering quantum computing / multi-target attacks. Going higher doesn't make much sense. If it is smart to increase the number of rounds depends on the algorithm. Maybe a conservative number of rounds was already used. On the other hand, the extension of the key schedule may require that more rounds are used. A good example is of course AES, where 10, 12 or 14 rounds are used depending on the key size.

This might not be necessary if the internal state and / or number of rounds is large enough already. But please be aware that HKDF is not an efficient way of expanding keys. You don't want a very heavy key scheduler because of the amount of instructions (which in turn mean gates when using an hardware implementation) required to execute it. And HKDF would also be considered way too compute intensive during initialization. This may be fine in your situation, but it doesn't work for a generic cipher.

  • 1
    $\begingroup$ The real issue with 128 bit keys is multitarget attacks (e.g. CTR mode with null IV). $\endgroup$
    – forest
    Apr 29, 2021 at 0:25
  • $\begingroup$ I'm not sure this really answers the question as you only say "more than 128 bit security is not required" but then "upgrading to 256 bit security may be a good idea". So I'm a little confused. Is there a more straight-foward yes/no answer if the parameters of the question are narrowed to "Is using a larger key with a fixed block size and number of rounds more secure against attacks with classical (not quantum) computers?" $\endgroup$
    – jay.lee
    Apr 2, 2022 at 8:23
  • 1
    $\begingroup$ Most persons here would probably agree on "no". But if you have doubt I would error on the more secure. 14 rounds of AES is generally fine, AES is very fast especially if it is hardware accelerated (and in those other cases you could go to e.g. ChaCha20). Hope that satisfies your answer, but in the end there is this scale and it is unlikely to top completely to the left or right, and it is not very precise either. $\endgroup$
    – Maarten Bodewes
    Apr 2, 2022 at 10:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.