6
$\begingroup$

Rijndael was the only AES candidate which defined a different number of rounds for their 128, 192, and 256-bit versions (10, 12, and 14, respectively). The others had a fixed number of rounds (32 for Serpent, 16 for Twofish, etc.) regardless of the key size. Why was this? It may have reflected the intention of having three different security levels and leaning towards speed for the "lower" security level, but that still doesn't explain why only Rijndael did this instead of settling on, say, 14 rounds.

Is there some cryptographic attack which is unique to Rijndael which would warrant this?

Improve this question
$\endgroup$
2

1 Answer 1

Reset to default
10
$\begingroup$

The others had a fixed number of rounds (32 for Serpent, 16 for Twofish, etc.) regardless of the key size. Why was this? Is there some cryptographic attack which is unique to Rijndael which would warrant this?

During the second AES conference, the Rijndael team was asked about this design decision. They turned it around, and pointed out that smaller keys have a smaller level of security (and hence a lower threshold on what would be considered a break). After all, an attack that works with effort $O(2^{180})$ would be considered a break against a 256 bit key, but not against a 128 bit key, hence for 128 bit keys, you can get by with fewer rounds. The same type of reasoning would appear to be applicable to the other candidates (although it would be a tad more complicated with MARS, given that it uses multiple types of rounds internally).

Now, the Serpent team responded that they didn't want to give anyone a reason not to use 256 bit keys, hence they would not consider a faster version for shorter keys. As for the other three teams (MARS, RC6, Twofish), it appears that it just never occurred to them.

Improve this answer
$\endgroup$
6
  • 1
    $\begingroup$ This makes it sound like the Rijndael team made it only as secure as necessary and no more, so any cryptographic attack is no more difficult than a generic attack. Is this assessment correct? $\endgroup$
    – forest ♦
    Jan 17, 2021 at 5:13
  • $\begingroup$ That sounds right. It makes no sense to make your cipher more secure against attack A when there exists an attack B that is easier, because an attacker would not use attack A anyway. In particular, since brute force is in some sense the "stupidest" and "slowest" possible attack, making your cipher more secure than brute force is a waste of effort, especially if that also hurts performance. $\endgroup$
    – Jörg W Mittag
    Jan 17, 2021 at 13:12
  • $\begingroup$ @forest yes, and they insisted on that even during the third conference, and it is arguments [on the reports](Greg Rose ), too $\endgroup$
    – kelalaka
    Jan 17, 2021 at 13:41
  • 2
    $\begingroup$ @JörgWMittag: On the flip side, one cannot expect to know of all possible attacks against a cipher. If there exists a not-yet-discovered attack which would offer a break of AES-128 in time 2^60, but adding another round would increase the difficulty of that particular attack to 2^120, having an extra round could end up paying big dividends. $\endgroup$
    – supercat
    Jan 17, 2021 at 22:14
  • 2
    $\begingroup$ @forest: the Rijndael authors had to pick some number of rounds, and assume (with some evidence, but still an assumption) that was enough to make the cipher secure (defined as "no attack better than brute force"). However, that wasn't the question; the observation was that 256-bit AES had to sustain much stronger (computationally expensive) attacks than 128-bit AES, and because of that, having different numbers of rounds in those two cases was plausible, $\endgroup$
    – poncho
    Jan 18, 2021 at 3:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.