Advanced Encryption Standard process

(Redirected from AES finalists)

Process of developing the AES standard

The Advanced Encryption Standard (AES), the symmetric block cipher ratified as a standard by National Institute of Standards and Technology of the United States (NIST), was chosen using a process lasting from 1997 to 2000 that was markedly more open and transparent than its predecessor, the Data Encryption Standard (DES). This process won praise from the open cryptographic community, and helped to increase confidence in the security of the winning algorithm from those who were suspicious of backdoors in the predecessor, DES.

A new standard was needed primarily because DES had a relatively small 56-bit key which was becoming vulnerable to brute-force attacks. In addition, the DES was designed primarily for hardware and was relatively slow when implemented in software. While Triple-DES avoids the problem of a small key size, it is very slow even in hardware, it is unsuitable for limited-resource platforms, and it may be affected by potential security issues connected with the (today comparatively small) block size of 64 bits.

Start of the process

On January 2, 1997, NIST announced that they wished to choose a successor to DES to be known as AES. Like DES, this was to be "an unclassified, publicly disclosed encryption algorithm capable of protecting sensitive government information well into the next century." However, rather than simply publishing a successor, NIST asked for input from interested parties on how the successor should be chosen. Interest from the open cryptographic community was immediately intense, and NIST received a great many submissions during the three-month comment period.

The result of this feedback was a call for new algorithms on September 12, 1997. The algorithms were all to be block ciphers, supporting a block size of 128 bits and key sizes of 128, 192, and 256 bits. Such ciphers were rare at the time of the announcement; the best known was probably Square.

Rounds one, two, and three

In the nine months that followed, fifteen designs were created and submitted from several countries. They were, in alphabetical order: CAST-256, CRYPTON, DEAL, DFC, E2, FROG, HPC, LOKI97, MAGENTA, MARS, RC6, Rijndael, SAFER+, Serpent, and Twofish.

In the ensuing debate, many advantages and disadvantages of the candidates were investigated by cryptographers; they were assessed not only on security, but also on performance in a variety of settings (PCs of various architectures, smart cards, hardware implementations) and on their feasibility in limited environments (smart cards with very limited memory, low gate count implementations, FPGAs).

Some designs fell due to cryptanalysis that ranged from minor flaws to significant attacks, while others lost favour due to poor performance in various environments or through having little to offer over other candidates. NIST held two conferences to discuss the submissions (AES1, August 1998 and AES2, March 1999), and in August 1999 they announced that they were narrowing the field from fifteen to five: MARS, RC6, Rijndael, Serpent, and Twofish. All five algorithms, commonly referred to as "AES finalists", were designed by cryptographers considered well-known and respected in the community. The AES2 conference votes were as follows:

Rijndael: 77 positive, 1 negative
RC6: 79 positive, 6 negative
Twofish: 64 positive, 3 negative
MARS: 58 positive, 6 negative
Serpent: 52 positive, 7 negative
E2: 27 positive, 13 negative
CAST-256: 16 positive, 18 negative
SAFER+: 20 positive, 24 negative
DFC: 22 positive, 27 negative
Crypton: 16 positive, 31 negative
DEAL: 1 positive, 71 negative
HPC: 1 positive, 78 negative
MAGENTA: 1 positive, 84 negative
Frog: 1 positive, 86 negative
LOKI97: 1 positive, 86 negative

A further round of intense analysis and cryptanalysis followed, culminating in the AES3 conference in April 2000, at which a representative of each of the final five teams made a presentation arguing why their design should be chosen as the AES. The AES3 conference votes were as follows:

Rijndael: 86 positive, 10 negative
Serpent: 59 positive, 7 negative
Twofish: 31 positive, 21 negative
RC6: 23 positive, 37 negative
MARS: 13 positive, 84 negative

Selection of the winner

On October 2, 2000, NIST announced that Rijndael had been selected as the proposed AES and started the process of making it the official standard by publishing an announcement in the Federal Register on February 28, 2001 for the draft FIPS to solicit comments. On November 26, 2001, NIST announced that AES was approved as FIPS PUB 197.

NIST won praises from the cryptographic community for the openness and care with which they ran the standards process. Bruce Schneier, one of the authors of the losing Twofish algorithm, wrote after the competition was over that "I have nothing but good things to say about NIST and the AES process."

References

"cryptology:: The Data Encryption Standard and the Advanced Encryption Standard". Britannica.com. Archived from the original on May 14, 2014. Retrieved October 9, 2018.
"Announcing Development of a Federal Information Processing Standard for Advanced Encryption Standard". csrc.nist.gov. January 2, 1992. Retrieved October 9, 2018.
"Requesting Candidate Algorithm Nominations for AES". csrc.nist.gov. September 12, 1997. Retrieved October 9, 2018.
Georgoudis, Dianelos. "Live from the Second AES Conference, day 1". Cryptome. Retrieved April 7, 2019.
Georgoudis, Dianelos. "Live from the Second AES Conference, day 2". Cryptome. Retrieved April 7, 2019.
Georgoudis, Dianelos. "Discussion about Second AES Conference". Google Groups. Retrieved November 30, 2019.
"AES Development - Cryptographic Standards and Guidelines". csrc.nist.gov. December 29, 2016. Retrieved October 9, 2018.
"Development of the Advanced Encryption Standard" (PDF). 2021. Archived (PDF) from the original on August 20, 2021. Retrieved November 24, 2023.
"AES3 Conference Feedback Form - Summary" (PDF). April 28, 2000. Archived (PDF) from the original on November 24, 2023. Retrieved November 24, 2023.
Swenson, Gayle (October 2, 2000). "Commerce Department Announces Winner of Global Information Security Competition". NIST. Retrieved October 9, 2018.
NIST (February 28, 2001). "Announcing Draft Federal Information Processing Standard (FIPS) for the Advanced Encryption Standard (AES) and Request for Comments" (PDF). Federal Register. 66: 12762. Archived (PDF) from the original on October 22, 2012. Retrieved October 9, 2018.
"Crypto-Gram: October 15, 2000 - Schneier on Security". www.schneier.com. October 15, 2000. Retrieved October 9, 2018.

External links

A historical overview of the process can be found on NIST's website.
On the sci.crypt newsgroup, there are extensive discussions about the AES process.

v t e Block ciphers (security summary)
Common algorithms	AES Blowfish DES (internal mechanics, Triple DES) Serpent SM4 Twofish
Less common algorithms	ARIA Camellia CAST-128 GOST IDEA LEA RC5 RC6 SEED Skipjack TEA XTEA
Other algorithms	3-Way Adiantum Akelarre Anubis Ascon BaseKing BassOmatic BATON BEAR and LION CAST-256 Chiasmus CIKS-1 CIPHERUNICORN-A CIPHERUNICORN-E CLEFIA CMEA Cobra COCONUT98 Crab Cryptomeria/C2 CRYPTON CS-Cipher DEAL DES-X DFC E2 FEAL FEA-M FROG G-DES Grand Cru Hasty Pudding cipher Hierocrypt ICE IDEA NXT Intel Cascade Cipher Iraqi Kalyna KASUMI KeeLoq KHAZAD Khufu and Khafre KN-Cipher Kuznyechik Ladder-DES LOKI (97, 89/91) Lucifer M6 M8 MacGuffin Madryga MAGENTA MARS Mercy MESH MISTY1 MMB MULTI2 MultiSwap New Data Seal NewDES Nimbus NOEKEON NUSH PRESENT Prince Q RC2 REDOC Red Pike S-1 SAFER SAVILLE SC2000 SHACAL SHARK Simon Speck Spectr-H64 Square SXAL/MBAL Threefish Treyfer UES xmx XXTEA Zodiac
Design	Feistel network Key schedule Lai–Massey scheme Product cipher S-box P-box SPN Confusion and diffusion Round Avalanche effect Block size Key size Key whitening (Whitening transformation)
Attack (cryptanalysis)	Brute-force (EFF DES cracker) MITM Biclique attack 3-subset MITM attack Linear (Piling-up lemma) Differential Impossible Truncated Higher-order Differential-linear Distinguishing (Known-key) Integral/Square Boomerang Mod n Related-key Slide Rotational Side-channel Timing Power-monitoring Electromagnetic Acoustic Differential-fault XSL Interpolation Partitioning Rubber-hose Black-bag Davies Rebound Weak key Tau Chi-square Time/memory/data tradeoff
Standardization	AES process CRYPTREC NESSIE NSA Suite B CNSA
Utilization	Initialization vector Mode of operation Padding

v t e Cryptography
General	History of cryptography Outline of cryptography Classical cipher Cryptographic protocol Authentication protocol Cryptographic primitive Cryptanalysis Cryptocurrency Cryptosystem Cryptographic nonce Cryptovirology Hash function Cryptographic hash function Key derivation function Secure Hash Algorithms Digital signature Kleptography Key (cryptography) Key exchange Key generator Key schedule Key stretching Keygen Machines Cryptojacking malware Ransomware Random number generation Cryptographically secure pseudorandom number generator (CSPRNG) Pseudorandom noise (PRN) Secure channel Insecure channel Subliminal channel Encryption Decryption End-to-end encryption Harvest now, decrypt later Information-theoretic security Plaintext Codetext Ciphertext Shared secret Trapdoor function Trusted timestamping Key-based routing Onion routing Garlic routing Kademlia Mix network
Mathematics	Cryptographic hash function Block cipher Stream cipher Symmetric-key algorithm Authenticated encryption Public-key cryptography Quantum key distribution Quantum cryptography Post-quantum cryptography Message authentication code Random numbers Steganography
Category

Categories:

Misplaced Pages