Is this encryption method sensitive to weak keys? Is there any reference in the NIST on the AES key's entropy? (For example, must it have been generated from a TRNG?)

Can I safely use the Microsoft CAPI for key generation? (pseudorandom number generation)

Am I required to use true random number generation?


AES doesn't require uniformly distributed keys. However, if you have a key with less than 256 bits of entropy, then naturally your keyspace will be smaller than the maximum. Whether or not this is an issue depends on just how few bits you have. The only time a non-random key is bad for AES is when it's chosen very specifically to be harmful, in which case it can be used for a related key attack.

If your input is not uniformly distributed though, the standard technique is to pass it through a hash function like SHA-256 first, which compresses it to 256 uniformly-distributed bits. Or use a KDF.

  • $\begingroup$ so prng is good enough without KDF? $\endgroup$ – Offir Jul 30 at 10:08
  • $\begingroup$ is there any need for TRNG based key? $\endgroup$ – Offir Jul 30 at 10:08
  • 3
    $\begingroup$ A non-cryptographic PRNG is not good enough. As any documentation will tell you, use a CSPRNG. $\endgroup$ – tylo Jul 30 at 11:58
  • 1
    $\begingroup$ @EllaRose What I meant is that, if you use a non-uniform key with, say, 100 bits of entropy for 256-bit AES, you won't be getting under 100 bits of effective keyspace. Naturally if you give it a key so bad that it only has 30 bits of entropy, then your key is too weak in the first place, regardless of whether you use a KDF. $\endgroup$ – forest Jul 31 at 4:52
  • 1
    $\begingroup$ @EllaRose In particular, the attack Squeamish Ossifrage mentions is the well-known related key attack against AES256 and AES192, which require very carefully chosen keys. You aren't going to find a related pair of keys by accident. I'm not sure why they chose to state in bold that you shouldn't "expect security". $\endgroup$ – forest Aug 3 at 8:34

Your Answer

