This is a historical question. In the third AES Conference of NIST (AES3), April 13-14, 2000, New York, near the end of the conference, one representative for each of the last 5 candidates sit on a table and people asked questions to them.

One interesting question was;

  • Except for your proposal for AES, what is your candidate?

As far as I can remember, the representative of Rijndael was the last to answer, was sitting on the right end. The first 3 were simply said The Rijndael. But, the 4. person said I want 32-round Rijndael

  • Was he Bruce Schneier? See his suggest on his Blog.
  • What was the choice of the representative of Rijndael?
  • 4
    $\begingroup$ I think it may have been the representative for the Serpent team (Ross Anderson?); however it's been a while... $\endgroup$ – poncho Nov 12 '18 at 19:49
  • 1
    $\begingroup$ So, you were there, too? $\endgroup$ – kelalaka Nov 12 '18 at 19:51
  • 2
    $\begingroup$ Yup...…..………... $\endgroup$ – poncho Nov 12 '18 at 19:52
  • $\begingroup$ @kelalaka Rijndael cipher was selected by NIST (==NSA), Serpent had 32 rounds and a high security margin. why Rijndael with 10-14 rounds?? Ask NSA! $\endgroup$ – 0skar Nov 13 '18 at 18:14
  • $\begingroup$ @0skar we are not talking about why 10 round. I want to remember historical part of the conference. It is 10 round because the designers are sure about their design?. They even did not consider 16 rounds. $\endgroup$ – kelalaka Nov 13 '18 at 18:31

This answer is based on Morris Dworkin's report of the conference, so it ultimately relies on its accuracy (it is probably more reliable than memory, though).

Regarding the question "Except for your proposal for AES, what is your candidate?", the report states (page 15):

The panelists were asked which algorithm, other than their own, they would choose for the AES. Rijmen liked RC6; the other four panelists said Rijndael if it was extended to 18 or more rounds.

So this suggests that the representative for Rijndael (Vincent Rijmen) chose RC6.

During his presentation at the conference, Bruce Schneier is reported to have ended with the following suggestions (page 15 as well):

He [Schneier] recommended that NIST choose either Rijndael extended to 18 rounds, Serpent, or Twofish for the AES; he favored Twofish for its efficiency across the board, its unique flexibility, and its speed-security tradeoff.

Since he suggested 18 rounds here, it would surprise me if he would argue for 32 rounds later the same day.

So the representative who answered "Rijndael with 32 rounds" was either Shai Halevi (MARS), Ron Rivest (RC6) or Ross Anderson (Serpent). My personal guess would be Ross Anderson (this would make sense because Serpent has 32 rounds). In fact, on page 16 of the report there is some weak evidence pointing in this direction:

Anderson responded to a suggestion to transfer some of Serpent’s rounds to Rijndael by reiterating his support for 32 round Serpent with 256 bit keys.

  • 1
    $\begingroup$ It would be nice to hear from people who were at the conference whether or not this roughly corresponds to what they remember. $\endgroup$ – Aleph Nov 13 '18 at 14:57
  • 1
    $\begingroup$ It looks like consensus was on Rijndael extended to 18 rounds, and we got Rijndael with 10, 12 or 14 rounds. That's bait for conspiracy theorists. $\endgroup$ – fgrieu Nov 13 '18 at 15:19
  • $\begingroup$ @fgrieu Well, I remember that people are not satisfied with the 10 rounds, considering the future security. $\endgroup$ – kelalaka Nov 13 '18 at 15:25
  • 1
    $\begingroup$ @fgrieu The consensus among the authors of competing submissions ;). I can imagine a few reasons why they wouldn't have recommended Rijndael outright... $\endgroup$ – Aleph Nov 13 '18 at 17:48

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.