0
$\begingroup$

I understand there are already few question here which are similar but mine is a bit different in that I want to split AES 256 bit into two 128 bit key and then use a different AES key of 128bit to encrypt the two 128 bit key for transport of the key between two processor. is this secure to do? I am currently limited due to the design of my system. Following is what I require:

  • I need to transport the AES 256 across to another processor.
  • One of the processor is not as powerful for establishing a stronger common key. Therefore I need to be able to transport this with a weaker key
$\endgroup$
5
  • 1
    $\begingroup$ Nope! You will have 128-bit security. I won't write an answer since if you exactly define your problem we may find a solution. $\endgroup$
    – kelalaka
    Jul 6 at 15:05
  • $\begingroup$ Does this help? $\endgroup$
    – Sad.coder
    Jul 6 at 15:12
  • $\begingroup$ Sorry, its bit difficult to provide the design of the system but the jist of it is that $\endgroup$
    – Sad.coder
    Jul 6 at 15:12
  • $\begingroup$ what if I encrypt it with two different 128 bit keys? $\endgroup$
    – Sad.coder
    Jul 6 at 15:14
  • $\begingroup$ It should be fine, in my view. Why don't you execute DHKE? $\endgroup$
    – kelalaka
    Jul 6 at 17:57
1
$\begingroup$

I understand there are already few question here which are similar but mine is a bit different in that I want to split AES 256 bit into two 128 bit key and then use a different AES key of 128bit to encrypt the two 128 bit key for transport of the key between two processor. is this secure to do?

It only affords 128-bit security, because an attacker only needs to break the 128-bit transport key. Which is secure, but you don't gain any security from using a 256-bit key.


If you use two separate 128-bit keys, it actually gets a little bit tricky. If the attacker has some way of independently verifying that they correctly decrypted each half of the 256-bit key—for example, if the key encryption algorithm is authenticated—then they can decrypt by

  1. Finding the first 128-bit key by brute force ($2^{128}$ steps);
  2. Finding the second 128-bit key by brute force ($2^{128}$ steps);

which is $2^{128} + 2^{128} = 2 \times 2^{128} = 2^{129}$ steps, and thus you only get 129-bit security.

However, if the key encryption algorithm offers no way of verifying correct decryptions, and the 256-bit key is random, that attack doesn't work because there is no way of verifying at step #1 that you've got the correct key for the first half. The brute force algorithm then becomes:

  • For each possible value (out of $2^{128})$ of the first key:
    • For each possible value (out of $2^{128}$) of the second key:
      • Try decrypting each transported key half with that combination, and then decrypting the message with the 256-bit key you get.

And this is $2^{128} \times 2^{128} = 2^{128 + 128} = 2^{256}$ steps, and no better than just attacking the 256-bit key by brute force.

The encryption algorithms normally recommended these days are called "AEADs" (authenticated encryption with associated data), which would fall into the first category and thus you'd only get 129-bit strength. You'd have to use older, non-AEAD algorithms to transport the key halves.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.