Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If Camellia is of equivalent security and speed to AES, concerns arise.

First of all, assuming the above, why is Camellia so rarely used in practice? Why aren't there any breaks in Camellia? Does that mean that Camellia is currently more secure than AES, or is this a result of the lack of research on the cryptanalysis of the cipher?

share|improve this question
If i remember correctly, Camellia is used by yahoo for some reason – calccrypto Aug 22 '11 at 21:07
Yes, Yahoo! uses Camellia as the bulk cipher when TLS is used. What is more interesting is that they use a 1024-bit certificate... – Chris Smith Aug 23 '11 at 20:02
@ChrisSmith Seems they finally fixed that. the cert that I saw was 2048 bits. – Patrick M Sep 30 '13 at 16:28
up vote 44 down vote accepted

There are a variety of reasons why AES is more widely used:

  1. AES is a standard.

  2. AES has been vetted by cryptanalysts more extensively than Camellia. As a result, we can have greater confidence in the security of AES than in Camellia. Therefore, on the merits, there may be good reasons to choose AES over Camellia.

  3. AES is a government standard (FIPS). Government procurements may be required to comply with applicable government standards. Therefore, when selling to the government, AES may be required; if so, Camellia isn't an acceptable substitute.

  4. AES is a industry standard. No one will get fired for using AES. If (say) Apple uses AES, and AES gets broken, the newspaper headline won't be about Apple; it'll be about flaws in something everyone is using. On the other hand, if Apple uses Camellia and Camellia gets broken, the newspaper headline will be about why Apple took it upon themselves to deviate from industry standard practice and how that led to a security breach in their systems. Therefore, aside from its merits, there's an incentive to choose the industry standard.

  5. Camellia is patented. AES is unpatented and free for all to use, without patent encumbrances. Regardless of what licenses might be available, many people are a bit wary about any patented algorithm, due to uncertainty, IP risks, etc. If the unencumbered version is every bit as good, it's easier to use the unencumbered version. Also, it is possible that some open source crypto library developers may be less likely to implement Camellia, because of the potential patent situation or because of the reduced demand to the above factors, so standard crypto libraries are less likely to Camellia. Similarly, many standards bodies have a bias against patent-encumbered algorithms, when there are alternatives that are every bit as good; therefore, some standards bodies may be less likely to use Camellia when they standardize on network protocols that require crypto.

  6. AES is entrenched. AES is a brand name that is widely known and recognized. Also, AES is good enough. Camellia is newer, and the benefits of Camellia are unclear or not as well known. (In many contexts, Camellia has no obvious advantages, so a developer might not see any reason to adopt it instead of AES, if they already know and trust AES and consider AES adequate for their needs.) There's no shortage of other block ciphers out there that could be considered, but if AES is good enough, there's not much incentive to use them.

share|improve this answer
Strictly speaking, AES is a government standard in the US only. Both NESSIE (EU) and CRYPTREC (Japan) gave AES and Camellia equal status. – Henrick Hellström Feb 19 '12 at 1:39
NTT and Mitsubishi have apparently granted a royalty-free license on their patents on (an implementation of) Camellia --, however that license requires that the algorithms not be modified, which may prevent addition of Camellia to software under certain open source licenses, and may disturb those inclined to paranoia. – rakslice Jun 21 '12 at 20:33

As a bonus feature, AES has hardware support in Intel processors which implement the AES instruction set, with AMD support coming soon in their Bulldozer based processors.

The AES instructions set consists of six instructions.

Four instructions, namely AESENC, AESENCLAST, AESDEC, AESDECLAST, are provided for data encryption and decryption (the names are short for AES Encrypt Round, AES Encrypt Last Round, AES Decrypt Round, AES Decrypt Last Round). These instructions have both register-register and register-memory variants.

Two other instructions, namely AESIMC and AESKEYGENASSIST are provided in order to assist with AES Key Expansion (the names are short for AES Inverse Mix Columns, and AES Key Generation Assist).

This Intel document also goes into some other potential benefits of using their instruction set

Beyond improving performance, the new instructions help address recently discovered side channel attacks on AES. AES-NI instructions perform the decryption and encryption completely in hardware without the need for software lookup tables. Therefore using AES-NI can lower the risk of side-channel attacks as well as greatly improve AES performance

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.