After 20 years of AES, what are the retrospective changes that should have been made? I realize that this could be very opinion based, but I feel that there should be some solid information on AES at this point that could be referenced.  After 20 years, I expect that there should be a &quot;woulda, coulda, shoulda&quot; list somewhere.   For instance, I suspect that one could have gotten away with two fewer rounds, which would still have an acceptable security margin, but would this increase the speed of the cipher significantly.
Is there a comprehensive retrospective on AES in literature now that it has been used for 20 years?
Nobody seems to need a 192 bit version, we can do fine with just AES-128 and AES-256. Having a key that's 1.5 times the block size is a nuisance (or 0.75 times the block size if the block size is doubled).
The key schedules of AES-192 and AES-256 are vulnerable to attack; we could do with a better key schedule where even these attacks are avoided. They don't have much influence when the cipher is used for confidentiality, but we could do without those attacks regardless.
And while we're expanding the block size and fixing vulnerabilities to the key schedule anyway, we might as well make it suitable as underlying cipher for a cryptographic hash function and make it a tweakable block cipher.