The practical consequence is that the effective key length of AES is about 2 bits shorter than expected - it is more like AES-126, AES-190, and AES-254 instead of AES-128, AES-192, and AES-256. We think it is a significant step toward the understanding of the real security of AES."