7
$\begingroup$

Recently I have found out that Ukraine has its own symmetric encryption algorithm "Kalyna". Developers of this algorithm said that their algorithm is more secure than AES because of longer key length and lack of any vulnerabilities by hardware acceleration (like AES-NI in modern processors). Is it the truth, or is AES better?

$\endgroup$
  • $\begingroup$ By "tabs" i meant exploits pledged deliberately $\endgroup$ – user55326 Apr 29 '18 at 17:52
  • 11
    $\begingroup$ Note that "our algorithm is better because it uses more bits" is considered one of the signs of Cryptographic Snake Oil. $\endgroup$ – Harry Johnston Apr 29 '18 at 21:40
  • $\begingroup$ Kalyna with 512-bit key will not have a 128-bit block size like AES, it is not a direct comparison (and Kalyna is almost guaranteed to be more secure) $\endgroup$ – Richie Frame Apr 30 '18 at 9:10
  • $\begingroup$ @RichieFrame has spoken, Will you elaborate? $\endgroup$ – Q-Club May 1 '18 at 7:34
  • $\begingroup$ @Q-Club mainly [256-bit block 512-bit key] vs [128bit block 256-bit key], also kalyna s-boxes are not ccz equivalent (but more linear), key schedule is less linear and has higher diffusion than AES, rest of cipher structure is almost identical to AES $\endgroup$ – Richie Frame May 1 '18 at 18:26
17
$\begingroup$

... their algorithm is more secure rather AES because of longer key length and lack of any tables in hardware acceleration. Is it truth, or AES is better?

More key material

  • Using more key material does not improve security once you are already using enough key material to be secure.

  • Using more key material can even weaken the security of the design, or at least make the design less efficient.

    • The more bits you are working with, the longer it takes to diffuse them evenly through the rest of the state. This implies that larger keys (and larger states) need more rounds to achieve complete diffusion.
    • Insufficient diffusion is one of the leading causes of weaknesses

The goal of algorithm design is basically to hit the ideal balance between efficiency and security. Due to the fact that using excessive amounts of key material will degrade performance for no benefit in security, this raises a flag regarding the competency of the design.

That being said, if you intend to use the cipher to create a hash function, then a larger key size can be useful to compress more data per invocation of the cipher.

Lack of vulnerabilities in hardware acceleration

While it's correct that tables are a potential vulnerability in an implementation, few algorithms require the use of tables. As long as the table is a memoized function and not just an actual random permutation of words, then an implementation can always choose to evaluate the function discretely instead of using a lookup table. Note that if the table were to be an actual random permutation of words, it probably wouldn't provide good non-linearity.

Hardware acceleration is specified explicitly. The AES circuit is supported as a hardware instruction on modern Intel CPUs. It is thoroughly unlikely that this instruction will ever be replaced by Kalina Kaylna. As far as many (if not most if not all) consumers are concerned, the details of hardware accelerated Kalina Kalyna are of little concern and so are a moot point.

If you are concerned that the built-in AES circuit has deliberate vulnerabilities, you are always free to use a software implementation. While AES-NI will obviously be faster, and a softare implementation that uses tables will be fast but vulnerable to side channels, the average consumer probably does not need huge throughput anyways. So if those are a concern, you can always use an implementation that is designed to be resistant to side channel attacks.

Cryptanalysis

If you want cryptanalysis of AES, then you are free to investigate the huge amount of pre-existing research on the subject. AES has been around for years and is probably the single most heavily analyzed symmetric cipher, possibly only second to DES.

If you want cryptanalysis of Kalina, you're almost certainly out of luck. Searching for "Kalina cipher", I could not even find the proposal or definition of the design, let alone any analysis of it. Searching for "Kalina" on eprint.iacr yields no results.

Edit: With the correct spelling of the design, it is possible to locate the specification and there are a few (3) cryptanalysis results on eprint.iacr.

Because few, if any, will ever use it, it is probable that it will never receive any meaningful analysis from competent cryptographers. It is certain that it will never receive the same amount of analysis that AES has received. It is possible that some of analysis that will be performed (e.g. by NSA) will never be made public.

$\endgroup$
  • $\begingroup$ ok, but I want cryptanalysis of Kalina and AES $\endgroup$ – user55326 Apr 29 '18 at 18:15
  • 7
    $\begingroup$ This site is not meant for original research or for requesting references (of course we will include them if we think it helps us answer a question). However, the Cryptanalysis part of Ella's answer is about all you should expect here; anything else should be considered a bonus. $\endgroup$ – Maarten Bodewes Apr 30 '18 at 0:09
  • 3
    $\begingroup$ @s3rgp4r0dy It would help if the correct spelling was used. I think "Kalina" should be spelled "Kalyna". Then we would find research in the archive mentioned by Ella Rose. eprint.iacr.org/2015/650.pdf $\endgroup$ – Hugh Apr 30 '18 at 3:30
  • 2
    $\begingroup$ @Hugh You are right about the spelling. The paper itself seems to make more modest claims for the cipher than OP suggests. It doesn't read like snake oil. $\endgroup$ – John Coleman Apr 30 '18 at 11:24
  • 3
    $\begingroup$ "It is probable that it will never receive any meaningful analysis from competent cryptographers" - given it is mandated for use by the Ukrainian government, I would be amazed if Russian government cryptographers haven't given it pretty intensive scrutiny; I would be fairly surprised if GCHQ/NSA hadn't done likewise. OTOH we won't see the results of such cryptanalysis for a very long time. $\endgroup$ – Martin Bonner supports Monica Apr 30 '18 at 12:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy