The AES algorithm and asymmetric encryption use multiple key lengths that affect the strength on the key used. But, how does the key size and algorithm strength affect encryption strength?
Bigger key size means, harder to crack. Also note that an 256-bit key is not two times harder to crack from a 128-bit key, but many many times harder.
An algorithm uses difficult math functions in order to decide how to encrypt/decrypt, making it impossible for an attacker to bruteforce and find out the key. An algorithm might use harder math function than another algorithm thus requiring more time to encrypt/decrypt. Also the algorithms might have "bugs", making it easy to find out a few bits of the key, meaning an 256-bit algorithm to actually have 250-bit of true encryption since the 6 bits can be calculated easily.
I've heard you can figure out 1 bit in the AES algorithm easily, but still in order to crack AES and find out the rest of the bits you will still need many years, since you will have to find the rest of the key through bruteforce.
If enough bits of an encryption algorithm are easy to figure out, then the algorithm is "cracked", and its possible to find the key easily.
- Larger keys result in more secure encryption. Theoretically, each extra bit for the key should increase encryption strength two fold.
- If the algorithm has a weakness, security could be reduced considerably, and increasing key size might not considerably increase security if the weakness is severe. To illustrate how a weak algorithm can reduce security, consider a fairly ridiculous encryption standard I just made up with a critical weakness to illustrate the point. In this ridiculous standard, the key is simply added to the binary representation of the text each time you use it, and it is reused every time you encrypt. It would be very easy to crack this scheme by "encrypting" a bunch of binary 0's (then you would get the encryption key as an output). In this particular case where the encryption algorithm is ridiculously weak, key size would not matter, as it would be easy to crack no matter what the key size was.
- As far as AES goes, there have been some minor weaknesses discovered, but I believe it is still a very good encryption algorithm. Increasing the key size definitely increases security with AES.
For further information, please refer to:
One Time Pads are technically as safe as anything can get because decrypting a one time pad equals a brute force over the entire search space because the encrypted data has no information about the key. The effectiveness comes from the fact that the key length is equal or greater than the message.
What took me quite a bit is to understand why AES is less secure (but may still be secure enough): When your key is smaller than the message (as it is with AES and basically with everything that is not a one time pad) then you will effectively reuse the key during the encryption of the message blocks resulting in an encrypted message that actually has some information about the key in it. The effects are mitigated by using CBC modes, etc. Modes like ECB are therefore bad as they create encoded blocks that are independent from each other, whereas CBC et al. chain the different blocks to increase robustness of the encryption.
This is also the cause why a one time pad must not be used on a second message as it would simply result in the key length being smaller than the encoded message and yield in an encryption with a mode like ECB where both messages were encoded independently.