Well, not counting a full fledged quantum computer of course. In that case AES-256 does make sense. But we're some way off from getting that computer and even further away before it will be used to decrypt this kind of information.

That's fair. Once we have quantum computers capable of O(2^64) operations, I'll be worried about AES-128. I'll probably be dead by then, but hey.

I would be more concerned about my home WiFi and bank’s securities than my keyboard at that point.

I don't think that it's accurate to say that AES-256 is "not better". Indeed, both are secure against brute-force attacks. However, if some weaknesses are found, it's possible that they will hold for 10 rounds and not 14 rounds. Such things have happened before. What is true is that we have no such known weaknesses and we have very high confidence in AES-128. Therefore, it doesn't make sense to use AES-256 except for very high-security applications and very long term security. Keyboard encryption is not one of those cases.

@StephenTouset, by that time we probably won't use nowaday keyboards.

@YehudaLindell but then the AES-256 key schedule is a lot weaker regarding some types of attacks than the AES-128 key schedule which makes AES-256 less secure against some attacks.

@Tim I disagree. Getting into your WiFi does not necessarily compromise your online acitivites. Getting into your wireless keyboard connection provides the attacker with all your passwords and user names.

@daniel.neumann if they get get into AES 128, I assume they can crack https too. Perhaps that’s a poor assumption

@Tim Good point ;-)

@Josef: Related-key attacks are relevant only to badly designed protocols. Anyone serious about crypto protocol design will readily prevent them.

@stephen We already have quantum computers capable of O(2^64) operations. Even my old cellphone could do that. Now, 2^64 operations is not going to happen. Testing 2^64 passwords at once with quantum computers might. But it's still harder than you might think.

@daniel.neumann A keylogger will be of no use to an attacker when it comes to my passwords. All they'll get is CTRL+ALT+K (most likely not even then) and CTRL+V.

Even excluding quantum computers, cryptanalytic and implementation attacks, "nobody will crack a 128-bit key in the future of humanity as a species" is not quite sure: we are over $2^{88.4}$ SHA-256/year for silly bitcoin mining, quite consistently growing 2 bits per year, I doubt this is using truly state-of-the-art silicon, and who knows what resources a future equivalent of NSA could pull for a serious cause; plus, there's multi-key targets (when one has the same known value enciphered with multiple keys), which can save at least 10 bits.

This answer might be better if it noted what the 128 bit as was an upgrade to, which was the XOR of the serial number of the device on the bottom of the keyboard. I mean 256 bit is better

@fgrieu To get to $2^{128}$, we'd have to expend an amount of energy that would be enough to significantly raise the surface temperature of the Earth due to purely thermodynamic limits, namely the thermodynamic equilibrium resulting from our planet's surface area, limiting its ability to radiate heat energy into space.

At 70˚F ambient temperature, an optimal computer will consume roughly 4e-14 erg to flip a bit. To flip 127 bits (and have a 50% chance of cracking a 128-bit key), this will require 7e24 erg (7e17 J). Per the Do the Math blog, we're on track to hit this amount of global energy generation in 400 years at historical growth of 2.3% per year — and that's assuming Earth's entire energy budget is used for this task. At this rate of energy use, surface temperature is ~75˚C (167˚F) ignoring greenhouse effects. I stand by my statement.

Put another way, at a bit over thirty times our global annual power output (2.3% growth over 150 years), we will unavoidably increase the surface temperature of the Earth (again, ignoring greenhouse effects). Enumerating 127 bits with an optimal computer will take just shy of 10,000 times our global annual power output. It would take 314 years to power this computer at just under the threshold of risking global catastrophe using every last erg available to us. Assuming we dedicated half our annual increase — starting today and plateauing in 150 years — we're talking over 650 years.

If you think someone who can crack 128-bit encryption is monitoring you keystrokes buy a wired keyboard! Oh and a bunker to work in.

@Josef First, it is weaker than it should be but still stronger than 128. Second and much more important, a related key attack is not relevant to encryption uses of aes. Therefore, this argument is not relevant. Many people make this mistake. Related key attacks are relevant when you,wish to construct a hash function from aes or the like, not for its use in encryption where the attacker has no influence over the key.

@Stephen Touset: I agree with your math up to "7e17 J". That's less than 200000 GW.h, less than half of France's yearly electricity production (source wikipedia)! Ah and 1GW.h = $3600\cdot10^9$ J (unless physics or the definition of hour changed badly since my engineering degree :-)

@StephenTouset : I think I tracked the issue. Your source makes estimates in W (power), not W.year (energy). Pi seconds is a nanocentury, thus your estimate is off by a factor of 31 millions (nearly 25 bits). That does not make my assertion right, though. I asked a question.

Rut roh! Nice detective work!

I totally derped and misread the graph as W instead of J.

Or really, vice versa.

So half of France's yearly power generation to power a thermodynamically-optimal computer at room temperature for this task. I wonder how many orders of magnitude away a bit-enumerating ASIC would be.

Also, I wonder how many bit flips are necessary to actually enumerate a 128-bit counter! Incrementing by 1 flips more than one bit on average!