If Camellia is of equivalent security and speed to AES, concerns arise.

First of all, assuming the above, why is Camellia so rarely used in practice? Why aren't there any breaks in Camellia? Does that mean that Camellia is currently more secure than AES, or is this a result of the lack of research on the cryptanalysis of the cipher?

  • $\begingroup$ If i remember correctly, Camellia is used by yahoo for some reason $\endgroup$
    – calccrypto
    Commented Aug 22, 2011 at 21:07
  • 3
    $\begingroup$ Yes, Yahoo! uses Camellia as the bulk cipher when TLS is used. What is more interesting is that they use a 1024-bit certificate... $\endgroup$ Commented Aug 23, 2011 at 20:02
  • 1
    $\begingroup$ @ChrisSmith Seems they finally fixed that. the login.yahoo.com cert that I saw was 2048 bits. $\endgroup$
    – Patrick M
    Commented Sep 30, 2013 at 16:28
  • $\begingroup$ It would be nice if someone with cryptography expertise could comment on the actual differences and apparent advantages or disadvantages. People talk. Lots of people talk. That doesn't make them an expert. Show your creds and your standing in the cryptography field -- then speak on whether one should or shouldn't use a specific cipher...(just sayin). $\endgroup$ Commented Sep 24, 2023 at 1:29

3 Answers 3


There are a variety of reasons why AES is more widely used:

  1. AES is a standard.

  2. AES has been vetted by cryptanalysts more extensively than Camellia. As a result, we can have greater confidence in the security of AES than in Camellia. Therefore, on the merits, there may be good reasons to choose AES over Camellia.

  3. AES is a government standard (FIPS). Government procurements may be required to comply with applicable government standards. Therefore, when selling to the government, AES may be required; if so, Camellia isn't an acceptable substitute.

  4. AES is a industry standard. No one will get fired for using AES. If (say) Apple uses AES, and AES gets broken, the newspaper headline won't be about Apple; it'll be about flaws in something everyone is using. On the other hand, if Apple uses Camellia and Camellia gets broken, the newspaper headline will be about why Apple took it upon themselves to deviate from industry standard practice and how that led to a security breach in their systems. Therefore, aside from its merits, there's an incentive to choose the industry standard.

  5. Camellia is patented. AES is unpatented and free for all to use, without patent encumbrances. Regardless of what licenses might be available, many people are a bit wary about any patented algorithm, due to uncertainty, IP risks, etc. If the unencumbered version is every bit as good, it's easier to use the unencumbered version. Also, it is possible that some open source crypto library developers may be less likely to implement Camellia, because of the potential patent situation or because of the reduced demand to the above factors, so standard crypto libraries are less likely to Camellia. Similarly, many standards bodies have a bias against patent-encumbered algorithms, when there are alternatives that are every bit as good; therefore, some standards bodies may be less likely to use Camellia when they standardize on network protocols that require crypto.

  6. AES is entrenched. AES is a brand name that is widely known and recognized. Also, AES is good enough. Camellia is newer, and the benefits of Camellia are unclear or not as well known. (In many contexts, Camellia has no obvious advantages, so a developer might not see any reason to adopt it instead of AES, if they already know and trust AES and consider AES adequate for their needs.) There's no shortage of other block ciphers out there that could be considered, but if AES is good enough, there's not much incentive to use them.

  • 25
    $\begingroup$ Strictly speaking, AES is a government standard in the US only. Both NESSIE (EU) and CRYPTREC (Japan) gave AES and Camellia equal status. $\endgroup$ Commented Feb 19, 2012 at 1:39
  • 8
    $\begingroup$ NTT and Mitsubishi have apparently granted a royalty-free license on their patents on (an implementation of) Camellia -- ntt.co.jp/news/news01e/0104/010417.html, however that license requires that the algorithms not be modified, which may prevent addition of Camellia to software under certain open source licenses, and may disturb those inclined to paranoia. $\endgroup$
    – rakslice
    Commented Jun 21, 2012 at 20:33
  • 1
    $\begingroup$ AES also got hardware acceleration for desktop computers in 2005 or so. I have not seen the same for Camellia. That makes AES about 30x faster than a software-based Camellia implementation. $\endgroup$
    – user10496
    Commented Jul 10, 2018 at 16:32

As a bonus feature, AES has hardware support in Intel processors which implement the AES instruction set, with AMD support coming soon in their Bulldozer based processors.

The AES instructions set consists of six instructions.

Four instructions, namely AESENC, AESENCLAST, AESDEC, AESDECLAST, are provided for data encryption and decryption (the names are short for AES Encrypt Round, AES Encrypt Last Round, AES Decrypt Round, AES Decrypt Last Round). These instructions have both register-register and register-memory variants.

Two other instructions, namely AESIMC and AESKEYGENASSIST are provided in order to assist with AES Key Expansion (the names are short for AES Inverse Mix Columns, and AES Key Generation Assist).

This Intel document also goes into some other potential benefits of using their instruction set

Beyond improving performance, the new instructions help address recently discovered side channel attacks on AES. AES-NI instructions perform the decryption and encryption completely in hardware without the need for software lookup tables. Therefore using AES-NI can lower the risk of side-channel attacks as well as greatly improve AES performance

  • 1
    $\begingroup$ The AES-NI instructions can actually be used to accelerate Camellia as well, because Camellia and AES are so similar in their algorithmic structure. Basically, Camellia and AES are really similar, but Camellia has less adoptions, less vetting, and there doesn't seem to be any good reason to use it other than just because "Camellia is Japanese and AES is America." $\endgroup$
    – Dan Lenski
    Commented Jul 24, 2018 at 19:37

Maybe Camellia might get more popular after its patents did expire for good. It is "japanese-make" and the fareastern browser and server environments are widely using it. This is because Japanese people still live in a mind policy like "only japanese things are reliable or can be trusted" (umm... which isn't the case actually seen from more neutral standpoint, regarding "people" or "makers" because they are finally humans as well with all imperfections given to the human race) OR if its authors expicitely (officially and permanently!) step back and keep distant from any further claims including possible future fees or renewals of their patents in this algorithm. (and yes put it under opensource or the gnu terms after patent expiration - means making the source officially public to allow further vetting and maybe improval by the public audience and expertise). And making it a defined standard finally as well. Why only having one blockcipher standard (AES)? Ah, yes there is still another standard: ChaCha20 - which is made for streams.B

  • 1
    $\begingroup$ Actually, I have no seen any insistence from the Japanese that products we (US) sell to them support Camellia; they are quite happy with AES. This observation contradicts (at least in this case) the claim that "Japanese people still live in a mind policy like "only japanese things are reliable or can be trusted"" $\endgroup$
    – poncho
    Commented Sep 24, 2023 at 1:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.