# Why was Rijndael the only cipher to have a variable number of rounds?

Rijndael was the only AES candidate which defined a different number of rounds for their 128, 192, and 256-bit versions (10, 12, and 14, respectively). The others had a fixed number of rounds (32 for Serpent, 16 for Twofish, etc.) regardless of the key size. Why was this? It may have reflected the intention of having three different security levels and leaning towards speed for the "lower" security level, but that still doesn't explain why only Rijndael did this instead of settling on, say, 14 rounds.

Is there some cryptographic attack which is unique to Rijndael which would warrant this?

• Jan 17, 2021 at 12:37
• @kelalaka I think 18 rounds would have been more realistic, but at least I'm glad that it's held up to intense analysis over the decades.
– forest
Jan 18, 2021 at 1:22

The others had a fixed number of rounds (32 for Serpent, 16 for Twofish, etc.) regardless of the key size. Why was this? Is there some cryptographic attack which is unique to Rijndael which would warrant this?

During the second AES conference, the Rijndael team was asked about this design decision. They turned it around, and pointed out that smaller keys have a smaller level of security (and hence a lower threshold on what would be considered a break). After all, an attack that works with effort $$O(2^{180})$$ would be considered a break against a 256 bit key, but not against a 128 bit key, hence for 128 bit keys, you can get by with fewer rounds. The same type of reasoning would appear to be applicable to the other candidates (although it would be a tad more complicated with MARS, given that it uses multiple types of rounds internally).

Now, the Serpent team responded that they didn't want to give anyone a reason not to use 256 bit keys, hence they would not consider a faster version for shorter keys. As for the other three teams (MARS, RC6, Twofish), it appears that it just never occurred to them.

• This makes it sound like the Rijndael team made it only as secure as necessary and no more, so any cryptographic attack is no more difficult than a generic attack. Is this assessment correct?
– forest
Jan 17, 2021 at 5:13
• That sounds right. It makes no sense to make your cipher more secure against attack A when there exists an attack B that is easier, because an attacker would not use attack A anyway. In particular, since brute force is in some sense the "stupidest" and "slowest" possible attack, making your cipher more secure than brute force is a waste of effort, especially if that also hurts performance. Jan 17, 2021 at 13:12
• @forest yes, and they insisted on that even during the third conference, and it is arguments [on the reports](Greg Rose ), too Jan 17, 2021 at 13:41
• @JörgWMittag: On the flip side, one cannot expect to know of all possible attacks against a cipher. If there exists a not-yet-discovered attack which would offer a break of AES-128 in time 2^60, but adding another round would increase the difficulty of that particular attack to 2^120, having an extra round could end up paying big dividends. Jan 17, 2021 at 22:14
• @forest: the Rijndael authors had to pick some number of rounds, and assume (with some evidence, but still an assumption) that was enough to make the cipher secure (defined as "no attack better than brute force"). However, that wasn't the question; the observation was that 256-bit AES had to sustain much stronger (computationally expensive) attacks than 128-bit AES, and because of that, having different numbers of rounds in those two cases was plausible, Jan 18, 2021 at 3:52