Unclear rationale for AES weak key logic

[AaronFeickert]

A test for weak AES keys was added in #465, citing a TCG document stating that a non-weak key must have at least one upper key bit set.

Is it known from where this claim arises? The linked document does not provide citation or reasoning for the claim, and the claim does not appear to be covered by standards like FIPS 197. Has later work established it? If so, it may be useful to document.

[newpavlov]

cc @baloo

[baloo]

I'm not aware of any documentation on TCG's claims.

[AaronFeickert]

I would suggest removing the test if there isn't demonstrable justification for it. Will open a PR for discussion.

[tarcieri]

Any symmetric key that's supposed to be full entropy (i.e. 128-bits or longer) with one contiguous half of its bits set to zero is a pretty clear sign the key was not generated in a uniformly random manner.

For a 128-bit key, there's a 1:18446744073709551616 chance of that happening.

[AaronFeickert]

Sure, but you could add an almost infinite number of tests in that manner. Is there known reasoning for the claim on this particular test?

[tarcieri]

I just spelled out a rationale here: #526 (comment)

[AaronFeickert]

I read it but really disagree with this rationale. Why not include a test against an all-zero key, or an all-one key? Those are also unlikely to occur by chance. My read of the intent of the weak-key test is that it is intended to guard against keys that are weak for reasons other than external failures of generation. Is this not the case?

[tarcieri]

As I said on that issue, you are making a slippery slope argument