Lack of response to CAESAR competition

Question

Why is there so little response (e.g. implementation in crypto libraries, programs...) after the end of the CAESAR competition? As far as I can see, there is no shift from AES-GCM to any of the CAESAR algorithms. The response to the Password Hashing Competition, for example, was greater, at least in my perception. Is there a reason for that?

Answer 1

CAESAR competition did not result in any standard.

I think it is because AES-GCM is already widely adopted (with hardware support, although some CAESAR algorithms also use AES) and CAESAR didn't bring anything significantly new. For example OCB was known before, but it is not widely adopted because it is patented (seems like patents have expired now). I guess CAESAR was too late for industry. There is no compelling reason to shift from AES-GCM.

Possibly Ascon and ACORN are being adopted, but we don't know as they are embedded in small devices. Ascon is also one of NIST lightweight finalists.

Password Hashing Competition did bring more as we only had PBKDF, bcrypt, scrypt.

EDIT: I said there are no compelling reason to shift from AES-GCM, but there are many reasons. However, it seems industry doesn't consider them as significat or is slow to adopt something new when there is already well established de facto standard. It seems new ciphers are slowly getting adopted, see the other answer.

Answer 2

The current accepted answer is out of date and somewhat misleading. Disclaimer: I'm an author on the AEGIS Internet-Draft I'm about to talk about.

AEGIS (technically AEGIS-128L and AEGIS-256) has an Internet-Draft and TLS cipher suite name. It's in libsodium, the Zig programming language standard library, the Linux kernel, OVH routers, VPN software, and being used in internal deployments. At present, there are known implementations in 9 programming languages. There are also Project Wycheproof test vectors from Google.

Moreover, there are compelling reasons to shift from AES-GCM. AEGIS is the perfect example of that:

• Significantly faster than AES-GCM and AES-OCB with AES-NI. Software implementations are normally faster too. Speed is one of the main reasons AES-GCM is used.
• Easy to implement compared to AES-GCM especially but also AES-OCB. It's merely processing AES blocks, some XORs, and calling the AES round function. Additionally, the Internet-Draft has very readable pseudocode and test vectors that can be copied and pasted nicely, unlike some RFCs.
• Better security bounds (e.g. 128-bit security against forgery attacks for a 128-bit tag).
• Went through the CAESAR competition and is still receiving analysis. Other similarly fast algorithms like Rocca-S have received less analysis.
• Key committing assuming the associated data cannot be attacker-controlled. AES-GCM, AES-OCB, ChaCha20-Poly1305, and so on are not, enabling vulnerabilities in certain scenarios like the partitioning oracle attack. This is an AEAD design flaw that must be fixed. However, AEGIS is unfortunately not fully committing as originally thought.
• Larger nonces (128 bits for AEGIS-128L and 256 bits for AEGIS-256), meaning they can safely be random.
• Leaking a state doesn't leak the key nor previous states, which is the case with some other AES-based AEADs.
• Different associated data with the same key/nonce results in a different keystream, which provides some resistance against key reuse in different contexts.
• Suitable as an efficient MAC independent from encryption. Capable of 128- and now 256-bit tags.

Then NIST has decided to standardise Ascon, a CAESAR finalist, for lightweight cryptography applications. The fact it succeeded in two competitions suggests one can be confident it is safe and worth using.

Finally, regarding the slow/lack of response, I would like to draw your attention to this answer to another CAESAR question. This aides the existing answer, which makes a good point about AES-GCM being widely adopted. It always takes a while for new algorithms to be adopted.