# Why did FIPS become the AES Standard . What is wrong with Twofish and Serpent? [duplicate]

Why did FIPS become the AES Standard . What is wrong with Twofish and Serpent ? Is there a security vulnerability in Twofish / Serpent ? How do thy work ? As far as i know Twofish and Serpent are used in Some modern encryptions .

Sorry for the dumb question . I am only 16 and I dont really know much about Cryptography .

• Do you mean Rijndael not FIPS? – CodesInChaos Dec 8 '16 at 16:30
• It's called FIPS (Federal Information Processing Standard) because that's what NIST calls its IT standards. – CodesInChaos Dec 8 '16 at 16:36

Welcome to the site! I'll try and give the general answer you're looking for:

When NIST ran the AES competition in 1997 - 2000 to select the best symmetric cipher, they were looking for an algorithm that was well-balanced across a range of uses. The winner was the Rijndael cipher, which we now simply call AES.

The goal of the Advanced Encryption Standard (AES) competition was to specify "an unclassified, publicly disclosed encryption algorithm capable of protecting sensitive government information well into the next century". The AES competition was organized by the United States National Institute of Standards and Technology (NIST). [source: cr.py.to group]

The cr.py.to page lists the complex criteria that NIST was looking for in choosing a winner; it includes things like CPU and memory usage, easy to implement in both hardware and software, soundness of the mathematical theory behind it, etc. Rijndael was chosen because it scored the best across all categories.

If you checkout the wikipedia page for the AES competition, you'll see this:

All five algorithms, commonly referred to as "AES finalists", were designed by cryptographers considered well-known and respected in the community. The AES2 conference votes were as follows:

Rijndael: 86 positive, 10 negative
Serpent: 59 positive, 7 negative
Twofish: 31 positive, 21 negative
RC6: 23 positive, 37 negative
MARS: 13 positive, 84 negative


As you can see, Serpent was a close second, and Twofish also had net positive votes. That doesn't mean that Serpent and Twofish are bad, just that Rijndael was a better fit for the complex criteria that NIST was looking for.