"Recently" the Ukraine standardized a new block cipher Kalyna, which according to the abstract of
"A New Encryption Standard of Ukraine: The Kalyna Block Cipher" by Oliynykov et al. (warning: the paper contains a lot of test-vectors) is basically a modified version of AES.

The high-level changes (to Rijndael) were described as "four new S-boxes, new pre- and post-whitening, a new larger MDS-matrix and a new key schedule".

What was the (likely main) reason to not standardize Rijndael or AES?

As a "bonus" / side question:
What was the (most likely) design rationale behind the changes being made to Rijndael?

  • 1
    $\begingroup$ I'm not too sure if the second question should have its own (1-4) questions, so please say so if it's "too much" with this question. $\endgroup$ – SEJPM Jul 2 '15 at 21:00
  • 1
    $\begingroup$ They are all about Kalyna it seems so I'm OK with the fact that there are sub-questions. On the other hand, "the most likely design rationale" is a kind of asking to be guessing. Do you have any other resources that we could read? There is only a short description of the cipher, bar the test vectors. $\endgroup$ – Maarten Bodewes Jul 2 '15 at 21:28
  • 1
    $\begingroup$ @MaartenBodewes, according to the paper I think I could just read the design rationale as they had some sort of crypto competition, however it may be the case that the original paper wasn't even public / in english. I think I may ask and redirect the authors here (hoping they speak english ;) ) so they may explain the world the rationale - on Crypto.SE. $\endgroup$ – SEJPM Jul 2 '15 at 21:30
  • $\begingroup$ I had some success doing exactly that on the security site. I just asked the author to respond. I think he was grateful to be notified. With a bit of luck we even get people to join this site :) $\endgroup$ – Maarten Bodewes Jul 2 '15 at 21:32
  • 1
    $\begingroup$ @MaartenBodewes, got two responses. I'll write up an answer very soon. Until then at least the some ressource I've been provided with. And they also stated they'll translate the (currentely russian) thesis to english soon (and ofc publish it).Description More Ressources Presentation $\endgroup$ – SEJPM Jul 3 '15 at 17:16

The most likely rationale to change the AES design is political. It's a NIST standard, designed in Western Europe.

It's a bad idea! How much scrutiny has it received? Almost none. How much will it receive? Almost none. Bad idea.

  • 1
    $\begingroup$ Note: it seems like this replaces the previous GOST algorithm, which is an 64 bit block cipher with 256 bit key from Russia. After reading the text it seems to me that the cipher was chosen by competition is mainly AES with some of its deficiencies fixed. The question is if the Ukraine has a large enough crypto community to verify correct operation, because I would say that the crypto community of the world hasn't looked at it. $\endgroup$ – Maarten Bodewes Jul 3 '15 at 10:51
  • 1
    $\begingroup$ I too am seeing a political gesture to show independence; focusing on a security issue (AES purely cryptanalytical attacks) that's not among the most worrying ones in actual use (lack or wrong of use of crypto, backdoors, exploitable software bugs, side channels to name a few); disregard of the reality that AES-NI is there (and fast, and secure from timing attacks), but KBC-NI is not; and a double-edged sword when it comes to enforcing the use of fresh crypto to force phase out of existing crypto gear and practices that might be obsolete or backdoored: are the new ones not backdoored? $\endgroup$ – fgrieu Oct 14 '20 at 6:23

I ("SEJPM" as of now) have contacted the authors asked them the same questions as in my question. I'm posting this as community wiki, as it's not my answer to this question but rather theirs. Now the responses follow:

First off, the authors are working on a design rationale in english for their new cipher. As soon as it's published, it will be linked here. The points in the following answer are either extracted from the e-mail answer to SEJPM or from linked materials and may not reflect the opinions of SEJPM.

What was the main reason not to standardize plain Rijndael or AES?

TL;DR: Kalyna has better security and performance properties than AES on modern CPUs.
The answer mentions that there needs to be a variety of ciphers, for constrained devices, for high-security, for fast software encryption, etc. Next point is that AES is good. But there are other solution like ChaCha which are getting standardized and AES isn't our cipher in the long-run, for the near future yes, but for long-term security we need a higher security level. The need for a new cipher was there, because higher perfomance on 64-bit platforms is needed as well as longer block- and keylengths. Kalyna was the result of this.

What was the design rationale behind the changes to the s-boxes?

For several years, the criterias for the selection of the s-boxes has been carefully done. The s-boxes chosen protect against algebraic attacks on AES as well as standard cryptanalytical attacks. Details may be found in this paper.

What was the design rationale behind the new whitening system?

Improved perfomance on 64-bit platforms and better security properties of the cipher, more information will follow in the design rationale paper.

Why was the MDS-matrix changed and expanded?

Security got enhanced by this change and it optimized speed more for 64-bit platforms as per the requirement on p. 65 of this document.

Why was the key schedule changed?

As explained on pages 74 and following of the presentation the key schedule should resist all known attacks on key-schedules and harden the cipher against attacks. It is required that leakage of a round-key doesn't easily compromise of all round keys. Absence of weak keys is another requirement as is simplicity of the schedule and side-channel attack resistance. Kalyna provides all these features, the key-schedule is basically a CSPRNG generating the round-keys, which was already done by Twofish and Blowfish, but Kalyna is significantly faster.

  • 1
    $\begingroup$ I'm not sure if this answer is "good". Feel free to edit the answer based on the linked resources and ask here if you think some information from the mails may be missing, I can bring up citations or ask for more details if needed. $\endgroup$ – SEJPM Jul 3 '15 at 19:49
  • 5
    $\begingroup$ There are known weakness to the AES key schedule. This means that it's a problem to use AES in hash-function constructions and other places where "ideal cipher" behavior is needed. However, note that the mainstream crypto community is making NO steps to change AES. This is because the slightest change to a cipher renders all of its previous scrutiny worthless. (This was actually demonstrated on DES where slight changes made it easy to break.) So, this is a VERY BAD IDEA; even if the claims are that it is to improve AES. $\endgroup$ – Yehuda Lindell Jul 5 '15 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.