Look I know AES256 is ridiculously secure but to keep aes secure even after quantum computers, I have a concern.
Using the Grovers theorem aes can be reduced from 256 to 128 bits for brute force attack which is also pretty strong but I don't want to be limited to it
Is it (atleast in theory) possible to implement aes512, aes1024, etc...
I mean what's stopping us like for 128bit aes we use 10 rounds of shuffling, for 192, 12 rounds and for 256, 14 rounds
Then a general rule can be said that for every 64 bits after 128 we increase the shuffling count by 2 and adding initial 10 at 128
By this rule we can say that aes512 the shuffling rounds will be 22 rounds then why has no one has ever did it?

  • $\begingroup$ Plenty of people "did it" - and it is not hard, it's just that not many people takes their results seriously. And that's required before NIST will even think about standardizing an algorithm (AES is nothing but standardized Rijndael cipher configurations). We generally aim for 128 bit security. It makes little sense to go beyond that, especially if those are operations performed on a (hypothetical) quantum computer. $\endgroup$
    – Maarten Bodewes
    Nov 11, 2021 at 13:43
  • $\begingroup$ By the way, Threefish (part of the Skein set of hash function implementation) has large key and block sizes. That's kind of by accident as they are required for the hash function, but yeah, you can still use that fact if you want to. $\endgroup$
    – Maarten Bodewes
    Nov 11, 2021 at 13:44