NIST explained the process of "Randomness Testing of the AES Candidate Algorithms" in the document.

The document explains the generation of 9 datasets for AES candidates with 128-bit block length and 128-key length. The document also state the number of streams and length of each stream that were set in NIST Statistical Test Suite for randomness testing.

However, the document does not state the process for 192-bit and 256-bit key lengths. Whereas AES candidates also support these two key settings.

From details of each test, one can generate all 9 data sets for 192 and 256 bit keys. But then what should be the stream length and number of streams to be tested, specially for the following tests where number of blocks to be generated is dependent on the key length.

  1. Key Avalanche
  2. Low Density Keys
  3. High Density Keys

Generating above three datasets for 256-bit key, results in much longer bit stream as compared to the one generated by 128-bit key length. So in order to analyze the complete bit stream, one should increase the "number of streams" parameter in NIST or "length of stream" parameter? If both the parameters to be increased, then what should be their value?

Going further, what should be the value of these two parameters for all 9 data sets for block ciphers with 256-bit block and key length?

  • $\begingroup$ AES doesn't allow a 256-bit block length. The moment you use parameters that aren't part of the AES standard it ceases to be AES, even if it's still valid Rijndael (the name of the underlying block cipher). $\endgroup$ Aug 18 '20 at 18:12
  • 1
    $\begingroup$ @SAIPeregrinus I think op is just asking how to perform that specific type of test on a 256-bit block length cipher (I hope) $\endgroup$ Aug 19 '20 at 2:07
  • $\begingroup$ @RichieFrame rightly pointed out by you. Thanks alot. $\endgroup$
    – crypt
    Aug 19 '20 at 4:27
  • 3
    $\begingroup$ The intention of this question seems unclear. Are you asking the length parameters NIST used to evaluate the algorithms at the 256-bit key length? In that case we don't know as it hasn't (to the best of my knowledge) been published (see csrc.nist.gov/publications/detail/nistir/6483/final), although it is implied that Plaintext/Ciphertext correlation uses 300 sample strings. Or are you simply asking how one would go about doing it themselves, in which case no modification is required to the method and the length parameters are fairly arbitrary. $\endgroup$
    – arcaynia
    Aug 20 '20 at 11:00
  • 1
    $\begingroup$ I guess an answer could (at least) say something on the amount of ciphertext / blocks required for testing with larger block / key sizes. Currently I expect that the question has not been answered because of the lack of clarity about what is needed, and I don't know if offering a bounty will therefore have an effect. $\endgroup$
    – Maarten Bodewes
    Aug 20 '20 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.