Was any specific rationale given on why none of the sponge-based AEAD algorithms (specifically NORX, Keyak, and Ketje) of the 3rd round candidates of the CAESAR competition made it to the final portfolio? If so, where can I find additional details?
$\begingroup$
$\endgroup$
This is an interesting question , here are some main points to identify major differences between Caesar winners and above-mentioned algorithm
Background
- Norx is LRX- Duplex based authenticated encryption scheme designed for lightweight and high-performance use cases.
- Ketje is Keccak-f-Duplex based authenticated encryption scheme designed for lightweight (except Ketje Major for high performance)
- Keyak is Keccak-f-Duplex based authenticated encryption scheme designed for high-performance (except River Keyak for lightweight)
- The winners of Lightweight use case are Ascon (SPN-duplex based authenticated encryption cipher and Acorn (stream based authenticated encryption).
- The winners of high-performance case are AEGIS (AES-Block cipher authenticated encryption), OCB (AES-XEX authenticated encryption) and MORUS (LRX-stream cipher )
Performance
A hardware benchmark on Virtex6 , Virtex-7 and Straix-IV shows the Acorn and Ascon have the lowest Area/$A_{GCM}$ compared to Norx , Ketje and Keyak (0.16 and 0.4 on average).
The hardware performance in term of throughput/ Area and throughtput/AES-GCM throughput for AEGIS and MORUS across Virtex6 , Virtex-7 and Straix-IV are very high compared to OCB , Ketje , Norx and Keyak.
The software performance in this chart shows the , AEGIS, OCB and MORUS have lower cycles per bytes (higher performance ) compared to Ketje , Norx and Keyak.
Security
- A paper presented in FSE 17 (cryptanalysis of NORX2) concluded Almost practical forgery and key recovery attack on NORX v2.0.
Further Details
- ATHENa project is hardware benchmark of Caesar candidates
- eBACS: ECRYPT Benchmarking of Cryptographic Systems
PS:Iam happy to see if someone provide more selection rationals.
