2
$\begingroup$

AES is the gold standard for symmetric encryption. It is highly trusted and highly secure. Do any other symmetric ciphers - besides OTP - come close to AES's usability, security, trust-ability?

$\endgroup$
6
  • 5
    $\begingroup$ ChaCha20 is in TLS 1.3. $\endgroup$
    – kelalaka
    Oct 22, 2019 at 19:35
  • $\begingroup$ OTP's because they're regaining popularity with the spread of quantum key distribution networks. $\endgroup$
    – Paul Uszak
    Oct 22, 2019 at 20:23
  • 7
    $\begingroup$ @PaulUszak: not according to the people I've talked to; when a QKD vendor touts message encryption, they always seem to use AES to perform the actual message encryption (because QKD bit rates are just too slow for OTP...) $\endgroup$
    – poncho
    Oct 22, 2019 at 22:00
  • $\begingroup$ There are many algorithms - SEED, CAST5, ChaCha20, just to name a few. All of this is available on Wikipedia. $\endgroup$
    – Legorooj
    Oct 23, 2019 at 2:37
  • $\begingroup$ Also Serpent, Twofish, Deoxys-II, Camellia $\endgroup$ Oct 23, 2019 at 5:06

1 Answer 1

2
$\begingroup$

ChaCha20

  • Provides 128 or 256-bit key space.
  • The best attack against 6 (128-bit) or 7 (256-bit) of 20 rounds
  • Stream cipher requires 64-bit nonce and 64-bit position counter
  • Used in TLS 1.3, OpenSSH, as well as BSD and Linux kernel RNGs
  • Part of ESTREAM portfolio

Serpent

  • Provides 128, 192, or 256 bit key space.
  • Best attack against 11 or 12 of 32 rounds
  • Block cipher with 128-bit block
  • AES competition finalist

Twofish

  • Provides 128, 192, or 256 bit key space.
  • Best attack against 6 of 16 rounds
  • Block cipher with 128-bit block and Feistel network design
  • AES competition finalist
  • Used in disk encryption software, OpenPGP standard, numerous applications

Deoxys-II

  • It provides 128 or 256-bit keyspace.
  • Authenticated encryption scheme with a 120-bit nonce, nonce misuse resistant
  • Based on 16-round tweakable block cipher using AES round function
  • Designed to provide better security than AES-GCM
  • Part of CAESAR portfolio for use case 3 (maximum security)

Camellia

  • Provides 128, 192, or 256-bit key space.
  • Block cipher with 128-bit block and Feistel network design
  • Patented but royalty-free
  • Used in OpenSSL, optional in OpenPGP and numerous other standards
  • Part of NESSIE and CRYPTREC portfolios

SEED

  • Provides 128-bit key space.
  • Best attack against 8 of 16 rounds
  • Block cipher with 128-bit block and Feistel network design
  • Used primarily in South Korea

CAST-256

  • Provides 128 to 256 bit security in 32-bit increments
  • Best attack against 28 of 48 rounds
  • Block cipher with 128-bit block and Feistel network design

There is the generic multi-target attack on n-bit key ciphers that requires less than the $2^n$ cipher evaluations.

$\endgroup$
4
  • $\begingroup$ ‘128-bit security or 256-bit security’ as used here is misleading, because the cost of a multi-target attack on a generic cipher with a 128-bit key is much less than about $2^{128}$ cipher evaluations. Consider just saying 128-bit key or 256-bit key instead? $\endgroup$ Oct 24, 2019 at 1:57
  • $\begingroup$ Why this list ? Why exclude other CAESAR winners or SM4, which most used than any of the above, except probably chacha20 ? $\endgroup$
    – Ruggero
    Oct 24, 2019 at 13:03
  • $\begingroup$ @Ruggero You are free to add. It is a community answer. $\endgroup$
    – kelalaka
    Oct 24, 2019 at 13:29
  • $\begingroup$ "Stream cipher requires 64-bit nonce and 64-bit position counter" - there are like 3 different standard ways to use chacha20 (the one that you mentioned, rfc7539's 32-bit counter and 96-bit nonce, and xchacha with 192-bit nonce and 64-bit counter). "Provides 128 or 256-bit key space" - you can theoretically use from 0 up to 384 or 512-bit keys with chacha20, thing is however, only 256-bit keys are really supported in the wild. I would also mention that chacha20 is much faster than the rest when implemented in software. $\endgroup$
    – Astolfo
    Oct 29, 2019 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.