I heard that Serpent and Twofish are much stronger than AES, but it was chosen because it is faster. If that's true, please tell me why it is stronger. Also: is it true that Twofish and serpent are better protected from brute force attacks because they take longer to en/decrypt?
$\begingroup$
$\endgroup$
1
asked Dec 11, 2016 at 21:15
-
1$\begingroup$ What does much stronger mean in the title? That is a very subjective term and might give the wrong indication, e.g. that it is actually possible to break any of those schemes. $\endgroup$– tyloAug 9, 2017 at 12:25
Add a comment
|
3 Answers
$\begingroup$
$\endgroup$
0
SHORT: This is kind of true. However, things are bit different now. Better protection against brute force is inaccurate claim.
At the time Rijndael (AES) won the competition, it was faster, and sufficiently strong. After the competition, Rijndael (AES) has gotten faster (AES-NI and other hardware improvements). Also Rijndael (AES) has also gotten significant amount of analysis, but it has not been broken in a practical way. Therefore, Rijndael (AES) has been shown to be quite good pick.
The other AES finalists are also believed to be very good, but as they've not been as standardized they will lack interoperability. Also, we've gotten very good in making Rijndael implementations during the last two decades. Because Serpent and Twofish have gotten less attention, it may be harder to find as good implementations of these algorithms than it is to find very good AES implementation.
The difference in en/decryption speed between these algorithms does not translate into any meaningful difference in protection against brute force attacks.
For more information, see also earlier answer by B-Con to similar question regarding advantages of Rijndael against Twofish and Serpent at: https://crypto.stackexchange.com/a/5290.
$\begingroup$
$\endgroup$
Here are quotes from Cryptography Engineering: Design Principles and Practical Applications (Niels Ferguson, Bruce Schneier, Tadayoshi Kohno) :
Serpent [...] is built like a tank. Easily the most conservative of all the AES submissions, Serpent is in many ways the opposite of AES. Whereas AES puts emphasis on elegance and efficiency, Serpent is designed for security all the way.
[...]
Twofish [...] can be seen as a compromise between AES and Serpent. It is nearly as fast as AES, but it has a larger security margin.
Which seems to imply that AES is indeed weaker than Twofish and Serpent.
Moreover, the paragraph about AES, in the same book, lists important advances that have been made against AES. It then says that it's still reasonable to use it, but advises to build "some flexibility" in new systems, "in case you need to replace AES with another block cipher in the future".
$\begingroup$
$\endgroup$
3
No, there is no mathematical proof to conclusively prove that Serpent and Twofish are stronger. The newer processors (intel, AMD, and even processors used in phones) have hardware instructions for AES, which apart from making AES much faster than the other two, defends against all kinds of side channel attacks (timing attacks, power consumption analysis etc). That means in practical sense AES is stronger than the other two.
-
3$\begingroup$ Serpent was designed to be resistant to timing/power analysis attacks from the beginning, making it more secure from that standpoint on devices that do not have AES instructions $\endgroup$ Jan 8, 2017 at 13:00
-
2$\begingroup$ There are power analysis attacks on Serpent, eprint.iacr.org/2009/473.pdf AES is stronger, especially as AES-NI will protect against most side channel attacks, and AES implementations have been studied and refined far better. AES in practice is stronger than Serpent. $\endgroup$ Jan 18, 2017 at 5:34
-
$\begingroup$ that seems like a hardware issue, where the hamming weight is exposed, and this type of flaw would apply to many algorithms, including AES. On a power critical platform, Serpent is designed to be a parallelized hardware implementation. $\endgroup$ Jan 18, 2017 at 8:13