AES is the gold standard for symmetric encryption. It is highly trusted and highly secure. Do any other symmetric ciphers - besides OTP - come close to AES's usability, security, trust-ability?
$\begingroup$
$\endgroup$
6
-
5$\begingroup$ ChaCha20 is in TLS 1.3. $\endgroup$– kelalakaOct 22, 2019 at 19:35
-
$\begingroup$ OTP's because they're regaining popularity with the spread of quantum key distribution networks. $\endgroup$– Paul UszakOct 22, 2019 at 20:23
-
7$\begingroup$ @PaulUszak: not according to the people I've talked to; when a QKD vendor touts message encryption, they always seem to use AES to perform the actual message encryption (because QKD bit rates are just too slow for OTP...) $\endgroup$– ponchoOct 22, 2019 at 22:00
-
$\begingroup$ There are many algorithms - SEED, CAST5, ChaCha20, just to name a few. All of this is available on Wikipedia. $\endgroup$– LegoroojOct 23, 2019 at 2:37
-
$\begingroup$ Also Serpent, Twofish, Deoxys-II, Camellia $\endgroup$– Richie FrameOct 23, 2019 at 5:06
|
Show 1 more comment
1 Answer
$\begingroup$
$\endgroup$
4
ChaCha20
- Provides 128 or 256-bit key space.
- The best attack against 6 (128-bit) or 7 (256-bit) of 20 rounds
- Stream cipher requires 64-bit nonce and 64-bit position counter
- Used in TLS 1.3, OpenSSH, as well as BSD and Linux kernel RNGs
- Part of ESTREAM portfolio
Serpent
- Provides 128, 192, or 256 bit key space.
- Best attack against 11 or 12 of 32 rounds
- Block cipher with 128-bit block
- AES competition finalist
Twofish
- Provides 128, 192, or 256 bit key space.
- Best attack against 6 of 16 rounds
- Block cipher with 128-bit block and Feistel network design
- AES competition finalist
- Used in disk encryption software, OpenPGP standard, numerous applications
Deoxys-II
- It provides 128 or 256-bit keyspace.
- Authenticated encryption scheme with a 120-bit nonce, nonce misuse resistant
- Based on 16-round tweakable block cipher using AES round function
- Designed to provide better security than AES-GCM
- Part of CAESAR portfolio for use case 3 (maximum security)
Camellia
- Provides 128, 192, or 256-bit key space.
- Block cipher with 128-bit block and Feistel network design
- Patented but royalty-free
- Used in OpenSSL, optional in OpenPGP and numerous other standards
- Part of NESSIE and CRYPTREC portfolios
SEED
- Provides 128-bit key space.
- Best attack against 8 of 16 rounds
- Block cipher with 128-bit block and Feistel network design
- Used primarily in South Korea
CAST-256
- Provides 128 to 256 bit security in 32-bit increments
- Best attack against 28 of 48 rounds
- Block cipher with 128-bit block and Feistel network design
There is the generic multi-target attack on n-bit key ciphers that requires less than the $2^n$ cipher evaluations.
-
$\begingroup$ ‘128-bit security or 256-bit security’ as used here is misleading, because the cost of a multi-target attack on a generic cipher with a 128-bit key is much less than about $2^{128}$ cipher evaluations. Consider just saying 128-bit key or 256-bit key instead? $\endgroup$ Oct 24, 2019 at 1:57
-
$\begingroup$ Why this list ? Why exclude other CAESAR winners or SM4, which most used than any of the above, except probably chacha20 ? $\endgroup$– RuggeroOct 24, 2019 at 13:03
-
$\begingroup$ @Ruggero You are free to add. It is a community answer. $\endgroup$– kelalakaOct 24, 2019 at 13:29
-
$\begingroup$ "Stream cipher requires 64-bit nonce and 64-bit position counter" - there are like 3 different standard ways to use chacha20 (the one that you mentioned, rfc7539's 32-bit counter and 96-bit nonce, and xchacha with 192-bit nonce and 64-bit counter). "Provides 128 or 256-bit key space" - you can theoretically use from 0 up to 384 or 512-bit keys with chacha20, thing is however, only 256-bit keys are really supported in the wild. I would also mention that chacha20 is much faster than the rest when implemented in software. $\endgroup$– AstolfoOct 29, 2019 at 15:36