Re: [Cfrg] matching AES security

[Sandy Harris <[e-mail]>]

D. J. Bernstein <[e-mail]> wrote:

> There are standard attacks that break _all_ of 2^50 AES-128 keys using a
> _total_ of 2^128 easy computations. Even worse, there are standard
> attacks that find _at least one_ of the keys using just 2^78 easy
> computations, a feasible computation today.
>
> These attacks assume that the attacker sees ciphertext for, e.g., an
> all-zero block encrypted under all of the keys. Sometimes protocols
> randomize their blocks to try to stop these attacks---but putting
> complications into protocols to compensate for a cipher's deficient
> security is _not_ a smart way to design a cryptographic system. For the
> past decade I've been recommending moving to larger cipher keys,
> precisely because of this attack against 128-bit keys.
....
> In a world of 2^50 AES-256 keys, there's an attack that already has a
> high probability of finding a key in time "only" 2^206.

Does the construction used in Enchilada solve those problems?
https://aezoo.compute.dtu.dk/doku.php?id=enchilada

It puts a 256-bit key into Chacha, then uses Chacha both to
generate AES round keys (so there is no 128-bit or 256-bit
AES key to attack) and to add whitening that changes for
every block (so common general attacks on block ciphers
all fail).