42
$\begingroup$

If Camellia is of equivalent security and speed to AES, concerns arise.

First of all, assuming the above, why is Camellia so rarely used in practice? Why aren't there any breaks in Camellia? Does that mean that Camellia is currently more secure than AES, or is this a result of the lack of research on the cryptanalysis of the cipher?

$\endgroup$
  • $\begingroup$ If i remember correctly, Camellia is used by yahoo for some reason $\endgroup$ – calccrypto Aug 22 '11 at 21:07
  • 3
    $\begingroup$ Yes, Yahoo! uses Camellia as the bulk cipher when TLS is used. What is more interesting is that they use a 1024-bit certificate... $\endgroup$ – Chris Smith Aug 23 '11 at 20:02
  • 1
    $\begingroup$ @ChrisSmith Seems they finally fixed that. the login.yahoo.com cert that I saw was 2048 bits. $\endgroup$ – Patrick M Sep 30 '13 at 16:28
59
$\begingroup$

There are a variety of reasons why AES is more widely used:

  1. AES is a standard.

  2. AES has been vetted by cryptanalysts more extensively than Camellia. As a result, we can have greater confidence in the security of AES than in Camellia. Therefore, on the merits, there may be good reasons to choose AES over Camellia.

  3. AES is a government standard (FIPS). Government procurements may be required to comply with applicable government standards. Therefore, when selling to the government, AES may be required; if so, Camellia isn't an acceptable substitute.

  4. AES is a industry standard. No one will get fired for using AES. If (say) Apple uses AES, and AES gets broken, the newspaper headline won't be about Apple; it'll be about flaws in something everyone is using. On the other hand, if Apple uses Camellia and Camellia gets broken, the newspaper headline will be about why Apple took it upon themselves to deviate from industry standard practice and how that led to a security breach in their systems. Therefore, aside from its merits, there's an incentive to choose the industry standard.

  5. Camellia is patented. AES is unpatented and free for all to use, without patent encumbrances. Regardless of what licenses might be available, many people are a bit wary about any patented algorithm, due to uncertainty, IP risks, etc. If the unencumbered version is every bit as good, it's easier to use the unencumbered version. Also, it is possible that some open source crypto library developers may be less likely to implement Camellia, because of the potential patent situation or because of the reduced demand to the above factors, so standard crypto libraries are less likely to Camellia. Similarly, many standards bodies have a bias against patent-encumbered algorithms, when there are alternatives that are every bit as good; therefore, some standards bodies may be less likely to use Camellia when they standardize on network protocols that require crypto.

  6. AES is entrenched. AES is a brand name that is widely known and recognized. Also, AES is good enough. Camellia is newer, and the benefits of Camellia are unclear or not as well known. (In many contexts, Camellia has no obvious advantages, so a developer might not see any reason to adopt it instead of AES, if they already know and trust AES and consider AES adequate for their needs.) There's no shortage of other block ciphers out there that could be considered, but if AES is good enough, there's not much incentive to use them.

| improve this answer | |
$\endgroup$
  • 25
    $\begingroup$ Strictly speaking, AES is a government standard in the US only. Both NESSIE (EU) and CRYPTREC (Japan) gave AES and Camellia equal status. $\endgroup$ – Henrick Hellström Feb 19 '12 at 1:39
  • 8
    $\begingroup$ NTT and Mitsubishi have apparently granted a royalty-free license on their patents on (an implementation of) Camellia -- ntt.co.jp/news/news01e/0104/010417.html, however that license requires that the algorithms not be modified, which may prevent addition of Camellia to software under certain open source licenses, and may disturb those inclined to paranoia. $\endgroup$ – rakslice Jun 21 '12 at 20:33
  • 1
    $\begingroup$ AES also got hardware acceleration for desktop computers in 2005 or so. I have not seen the same for Camellia. That makes AES about 30x faster than a software-based Camellia implementation. $\endgroup$ – user10496 Jul 10 '18 at 16:32
31
$\begingroup$

As a bonus feature, AES has hardware support in Intel processors which implement the AES instruction set, with AMD support coming soon in their Bulldozer based processors.

The AES instructions set consists of six instructions.

Four instructions, namely AESENC, AESENCLAST, AESDEC, AESDECLAST, are provided for data encryption and decryption (the names are short for AES Encrypt Round, AES Encrypt Last Round, AES Decrypt Round, AES Decrypt Last Round). These instructions have both register-register and register-memory variants.

Two other instructions, namely AESIMC and AESKEYGENASSIST are provided in order to assist with AES Key Expansion (the names are short for AES Inverse Mix Columns, and AES Key Generation Assist).

This Intel document also goes into some other potential benefits of using their instruction set

Beyond improving performance, the new instructions help address recently discovered side channel attacks on AES. AES-NI instructions perform the decryption and encryption completely in hardware without the need for software lookup tables. Therefore using AES-NI can lower the risk of side-channel attacks as well as greatly improve AES performance

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ The AES-NI instructions can actually be used to accelerate Camellia as well, because Camellia and AES are so similar in their algorithmic structure. Basically, Camellia and AES are really similar, but Camellia has less adoptions, less vetting, and there doesn't seem to be any good reason to use it other than just because "Camellia is Japanese and AES is America." $\endgroup$ – Dan Lenski Jul 24 '18 at 19:37
-3
$\begingroup$

Maybe Camellia might get more popular after its patents did expire for good. It is "japanese-make" and the fareastern browser and server environments are widely using it. This is because Japanese people still live in a mind policy like "only japanese things are reliable or can be trusted" (umm... which isn't the case actually seen from more neutral standpoint, regarding "people" or "makers" because they are finally humans as well with all imperfections given to the human race) OR if its authors expicitely (officially and permanently!) step back and keep distant from any further claims including possible future fees or renewals of their patents in this algorithm. (and yes put it under opensource or the gnu terms after patent expiration - means making the source officially public to allow further vetting and maybe improval by the public audience and expertise). And making it a defined standard finally as well. Why only having one blockcipher standard (AES)? Ah, yes there is still another standard: ChaCha20 - which is made for streams.B

| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.