total effective key length of the AESX-192

Question

If I have a AESX-192 be a block cipher which is similar to DESX but has the DES being replaced by AES and the AES key size is 192 bits.

How should I compute the total effective key length of the AESX-192.

Answer 1

The security bound for this construction is (PDF, section 4.7.3 in v4) $$\mathbf{Adv}^{\text{sPRP}}_{\text{AESX-192}}(\mathcal A)\leq \frac{2Q_sQ_{AES}}{2^{192}\cdot 2^{128}}$$ to be a strong PRP assuming AES can be modeled as an ideal cipher (not perfectly accurate but probably "close enough" here), where $Q_s$ is the number of "online" queries against a keyed oracle of the cipher and $Q_{AES}$ is the total number of AES evaluations for this.

So for an off-line brute-force search you actually get a 384-bit security strength, for a "online" security it breaks after $2^{160}$ queries. Therefore it may be easier to "just" use normal AES-192...