# Splitting an AES-256 key into two?

I understand there are already few question here which are similar but mine is a bit different in that I want to split AES 256 bit into two 128 bit key and then use a different AES key of 128bit to encrypt the two 128 bit key for transport of the key between two processor. is this secure to do? I am currently limited due to the design of my system. Following is what I require:

• I need to transport the AES 256 across to another processor.
• One of the processor is not as powerful for establishing a stronger common key. Therefore I need to be able to transport this with a weaker key
• Nope! You will have 128-bit security. I won't write an answer since if you exactly define your problem we may find a solution. Jul 6 '21 at 15:05
• Does this help? Jul 6 '21 at 15:12
• Sorry, its bit difficult to provide the design of the system but the jist of it is that Jul 6 '21 at 15:12
• what if I encrypt it with two different 128 bit keys? Jul 6 '21 at 15:14
• It should be fine, in my view. Why don't you execute DHKE? Jul 6 '21 at 17:57

I understand there are already few question here which are similar but mine is a bit different in that I want to split AES 256 bit into two 128 bit key and then use a different AES key of 128bit to encrypt the two 128 bit key for transport of the key between two processor. is this secure to do?

It only affords 128-bit security, because an attacker only needs to break the 128-bit transport key. Which is secure, but you don't gain any security from using a 256-bit key.

If you use two separate 128-bit keys, it actually gets a little bit tricky. If the attacker has some way of independently verifying that they correctly decrypted each half of the 256-bit key—for example, if the key encryption algorithm is authenticated—then they can decrypt by

1. Finding the first 128-bit key by brute force ($$2^{128}$$ steps);
2. Finding the second 128-bit key by brute force ($$2^{128}$$ steps);

which is $$2^{128} + 2^{128} = 2 \times 2^{128} = 2^{129}$$ steps, and thus you only get 129-bit security.

However, if the key encryption algorithm offers no way of verifying correct decryptions, and the 256-bit key is random, that attack doesn't work because there is no way of verifying at step #1 that you've got the correct key for the first half. The brute force algorithm then becomes:

• For each possible value (out of $$2^{128})$$ of the first key:
• For each possible value (out of $$2^{128}$$) of the second key:
• Try decrypting each transported key half with that combination, and then decrypting the message with the 256-bit key you get.

And this is $$2^{128} \times 2^{128} = 2^{128 + 128} = 2^{256}$$ steps, and no better than just attacking the 256-bit key by brute force.

The encryption algorithms normally recommended these days are called "AEADs" (authenticated encryption with associated data), which would fall into the first category and thus you'd only get 129-bit strength. You'd have to use older, non-AEAD algorithms to transport the key halves.