I have an embedded device with a secure memory of only 128 bits. I have to store the serial number (16 bits) and the AES key (128 bits) into this space.

What are the consequences of putting the 16 bits from the serial number into the key? Will it be the same as using a 112-bit key (still hard to crack) or it will allow attacker to crack easily the encryption?


There are no known attacks on AES that let an attacker turn partial knowledge of the key into full knowledge. If 16 bits of the key are easy to figure out, then you've got what is effectively a 112-bit key.

  • What's the minimum effective key size adviced ? NIST proposed phasing out 80-bit keys by 2015 : en.wikipedia.org/wiki/Key_size – hotips May 5 '15 at 15:18
  • @hotips, each additional bit of key length represents a doubling of brute-force difficulty. If an 80-bit key is just barely inadequate now, and assuming Moore's law continues to hold, a 112-bit key will be just barely inadequate in 2063. (This assumes no radical breakthroughs, such as a faster-than-brute-force attack, or a practical quantum computer.) – Mark May 5 '15 at 19:56

Can the serial be derived from the key?

My recommendation is to use a 128 bit secret and use truncated HMAC("serial", secret) to derive the serial and HMAC("encryption", secret) to encrypt.

If you have predetermined serials you must use and only have 128 bits to work with, I agree that using those 112 bits left is still safe. But you should still avoid related key attacks by hashing the 112 bit secret with the 16 bit serial to derive a 128 bit key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.