8
$\begingroup$

Can anyone explain (or give a link to document about) why Rijndaal won the AES, especially comparing it to other finalists (Serpent and Twofish)? What criteria were used to make decision?

Or is there detailed comparison of these algorithms including cryptographic strength, performance tests on different CPUs and maybe FPGA implementations (AFAIK i.e. Serpent's round can be fully parallelized in dataflow architectures) and also point if there are some general issues with these algorithms (i.e. attacks on AES-256 that makes it less strong than AE-S128)?

Improve this question
$\endgroup$
1

2 Answers 2

Reset to default
4
$\begingroup$

During the end of the contest the twofish team published a paper with their analysis where they discuss their thoughts and beliefs of what should happen. Futhermore they discuss the speed security tradeoff. Keep in mind this is a bit ago during the actual AES competition.

Improve this answer
$\endgroup$
3
  • 3
    $\begingroup$ Considering the keyed SBoxes of Twofish, it would be nice to see some more recent analysis of how well (or badly) Twofish resists timing attacks, when used for online communications. $\endgroup$
    – Henrick Hellström
    Feb 21, 2012 at 7:50
  • $\begingroup$ he article by Twofish creators state "Twofish has the most thoroughly explicated design of any AES candidate." Not saying it's right or wrong, but We would prefer a more neutral source, e.g. pdf @ crypto.stackexchange.com/a/5290/2373 $\endgroup$
    – Pacerier
    Apr 15, 2016 at 10:22
  • $\begingroup$ @HenrickHellström If I recall, Twofish is the most vulnerable to timing attacks of them all. AES often has AES-NI (and there are side-channel-resisting implementations), and Serpent can be easily implemented using bitslicing which is naturally resistant. Twofish's huge key-dependent S-boxes screw that up. $\endgroup$
    – forest ♦
    Mar 22, 2018 at 2:13
9
$\begingroup$

The final report is here http://csrc.nist.gov/archive/aes/index.html. All five finalists had at least adequate security on all accounts studied during the process, but Rijndael had better performance characteristics in both software and firmware on other hardware than 32 bit processors, compared to the other finalists.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Is the site down? $\endgroup$
    – Pacerier
    Apr 15, 2016 at 9:22
  • $\begingroup$ The link in the answer belongs to an archived part of the nist web site that is supposed to remain the same for the overseeable future. It is up now, and it is a static page so it rarely goes down. If you have trouble connecting the problem is more likely closer to your end. $\endgroup$
    – Henrick Hellström
    Apr 15, 2016 at 11:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.