AES encryption doesn't check key size

Author: APshenkinCreated May 25, 2020Updated May 18, 2026

There is it possibility to create 512bits key and pass it to AES.encrypt/decrypt functions.

e.g.

let key = CryptoJS.PBKDF2(pass, salt, {
    keySize: 512 / 32,
    iterations: iterations
  });

let encrypted = CryptoJS.AES.encrypt(msg, key, {
    iv: iv,
    padding: CryptoJS.pad.Pkcs7,
    mode: CryptoJS.mode.CBC
  });

This will produce non-standart key that will produce 22 AES rounds. But AES standard is defined so:

The key size used for an AES cipher specifies the number of transformation rounds that convert the input, called the plaintext, into the final output, called the ciphertext. The number of rounds are as follows:

10 rounds for 128-bit keys.
12 rounds for 192-bit keys.
14 rounds for 256-bit keys.

Source: brix/crypto-js

View original on GitHub View discussion on GitHub