3
$\begingroup$

NIST has a total of 3 approved block ciphers on their website: AES, TDES and skipjack.

I get why those are on there (though personally I find TDES a bit iffy) but from my understanding Twofish and Serpent are also good enough to make the list. so why aren't they there? are they too weak? have they been broken to an extend where they are no longer safe to use?

EXTRA:

I'm really interested in knowing why some ciphers are recommended and others aren't. I'm looking for an algorithm to use my self, to do this I want to make a selection of a few algorithms which are safe to use so I have a reason to fall back on when i'm asked why i chose for that specific cipher other than the standard excuse because it's AES (or NIST approved)

Are there credible sources I could quote for other algorithms (such as Twofish) which shows they are still reliable?

Improve this question
$\endgroup$
8
  • 1
    $\begingroup$ NIST simply chose a single candidate (rijndael) to become AES. This was about standardizing one secure choice, not about allowing all secure choices. 3DES and skipjack are only there for legacy support. $\endgroup$
    – CodesInChaos
    Mar 13, 2015 at 13:45
  • $\begingroup$ If you choose Serpent or Twofish in a production application and it fails, you can be sure that you will be blamed for not choosing the standard, no matter which sources you bring up to back your choice. $\endgroup$
    – fkraiem
    Mar 13, 2015 at 14:00
  • 1
    $\begingroup$ Now that AES has been around for over 15 years, Rijndael has had much more analysis done on it than the other AES candidates. At this point, other candidates probably should not be used without extremely compelling reasons not to use AES. $\endgroup$
    – cpast
    Mar 13, 2015 at 14:57
  • 1
    $\begingroup$ @Nova That is not a good reason, as the attack is not only impractical but also doesn't affect AES as it's actually used. Further, AES has much more analysis on it, so the fact that no attacks actually work in practice means more than the lack of results against the others. $\endgroup$
    – cpast
    Mar 13, 2015 at 20:05
  • 1
    $\begingroup$ @cpast: It's a reason to look for other algorithms than AES in advance. Attacks only get better, and breaking AES would also destroy the security of old data. If you want to securily store data for 30 years, AES may not be what you want to use - regardless of more analysis. It's all a matter of needed security. $\endgroup$
    – Nova
    Mar 13, 2015 at 20:26

2 Answers 2

Reset to default
5
$\begingroup$

The reason NIST chose one algorithm out of the five AES finalists, even though all of them were pretty well-respected (and some were, at the time, considered likely to be more secure then Rijndael) is because NIST is a standards body, and the whole point of the AES project was to find a standard algorithm. The issue with approving lots of algorithms is that you can easily end up with multiple standards-compliant implementations that can't talk to each other because they don't implement the same algorithm. AES is supported everywhere, and is reasonably fast on all platforms (plus, the fact that it's so common makes stuff like AES-NI practical).

These days, it seems to be common to have several algorithms in order to provide a fallback if a flaw is found in one (for instance, that's the point of SHA-3), but that's not the normal way standards agencies work, and even with SHA-3 NIST picked one algorithm. It's not thought of as "good enough to make the list;" the rule is "the algorithm that best meets our goals for this standard."

As for why Rijndael was chosen -- it was a good balance of security, software performance, hardware performance, and ease of implementation (or so it was thought at the time; it's actually kinda tricky to securely implement). Twofish and Serpent were believed more secure at the time, but other things like performance meant they weren't good for all uses. Since the point was creating one standard, they weren't chosen.

Improve this answer
$\endgroup$
5
  • 1
    $\begingroup$ I know how AES came to be but since twofish and serpent are also good why are they not mentioned on the site but TDES and skipjack are? I kind of get TDES even though it's at the end of it's life. but skipjack? just because the NSA created it it's there? it seems dubious, if skipjack's there serpent and twofish could be as well. but they are still secure right? $\endgroup$
    – Vincent
    Mar 16, 2015 at 7:54
  • $\begingroup$ @Vincent Because that's incompatible with the purpose of a standard. NIST does not have a list of approved algorithms, as such; they have approved standards, each of which was developed in a separate process (note that they don't list Rijndael, they list AES). They are not in the business of listing things that are "good enough;" that's actually the exact opposite of their job, which is to find one thing that people can all use (Skipjack and DES predated AES, and Skipjack and TDES are still believed secure, so those preexisting standards haven't been withdrawn yet). $\endgroup$
    – cpast
    Mar 16, 2015 at 15:00
  • $\begingroup$ The better question is why they should list Twofish and Serpent. Why should a standards body list multiple things that are all equally acceptable alternatives to the standard? Their primary job is to find standards, not to find good cryptographic algorithms. $\endgroup$
    – cpast
    Mar 16, 2015 at 15:02
  • $\begingroup$ yes oke but than why is skipjack there all fine and dandy if they select standards but skipjack has never had the scruteny DES or AES have. for as far as i can tell it's only on there because of the NSA. if they include skipjack they might as well include verything right? or just don't include skipjack on a page for official standards. i QUOTE: "NIST recommends not to use Skipjack after 2010." from csrc.nist.gov/publications/nistpubs/800-131A/sp800-131A.pdf So should i now put on my tinfoil hat? $\endgroup$
    – Vincent
    Mar 16, 2015 at 15:49
  • 1
    $\begingroup$ @Vincent Skipjack was standardized in FIPS 185, back in 1994. It provides 80-bit security; this is just now becoming weak against brute-force (and in fact, NIST is about to withdraw FIPS 185). Since it's in a FIPS, it's on the list. In contrast, Twofish and Serpent didn't fill some role AES didn't fill; as the point of standards is to reduce choices, they weren't put in an official standard. Since they aren't in a FIPS, they aren't on the list of "stuff in a FIPS." $\endgroup$
    – cpast
    Mar 16, 2015 at 21:33
2
$\begingroup$

Twofish and Serpent do not have any published non theoretical successful attacks (resulting in a complete break) so at this point in time they are considered secure. AES was chosen because the people making the decisions at NIST felt it made the best decisions (as far as the Rijndael spec goes) of making trade offs between security, speed, computing resources (memory and CPU), and ease of implementation.
This question may be a good starting point

How exactly was the finalist chosen in the NIST AES competition?

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.