We’re rewarding the question askers & reputations are being recalculated! Read more.

Tag Info

15

None of Twofish, Serpent and AES are currently known as broken, so as far as security is concerned, you can use any of them. AES has a slight advantage because it's very widely used, so if it gets broken you're more likely to hear about it and get relevant software updates quickly. The Snowden postings haven't changed much as far as cryptography usage is ...

11

AES has fewer rounds than Serpent so AES should be faster. The number of rounds by itself is meaningless. Some ciphers have a few complex rounds and others have many simple rounds. See my answer to Why does SHA-1 have 80 rounds? for a related explanation. There is no speed decrease with bigger key size in Serpent while there is in AES. The performance ...

9

Slowing block ciphers by increasing the number of rounds is an idea that does not catch because Compared to 15 years ago, the volume of data routinely enciphered by a computer has grown much more than the frequency of its CPU (even multiplied by number of cores and IPC improvements). Hence speed of ciphers is more important than it ever was. Correspondingly,...

9

SHORT: This is kind of true. However, things are bit different now. Better protection against brute force is inaccurate claim. At the time Rijndael (AES) won the competition, it was faster, and sufficiently strong. After the competition, Rijndael (AES) has gotten faster (AES-NI and other hardware improvements). Also Rijndael (AES) has also gotten ...

9

Serpent is straightforward to implement with side-channel resistance due to the bit-sliced design. Because AES incorporates an S-Box that is most simply implemented as a lookup table, implementations of it tend to be prone to side-channel attacks. Threefish was designed for the SHA-3 competition, and was intended to be a part of a sort of package of ...

8

I can see based upon your question that you're not already a crypto-expert. Given that, I think the single most useful answer I can give you is this: Multiple encryption addresses a problem that mostly doesn't exist. Modern ciphers rarely get broken -- at least, not in the Swordfish sense. You're far more likely to get hit by malware or an implementation ...

8

During the final round of the AES contest, NIST issued a summary of the 5 finalists on the topics of security, speed, implementation, and such. That sounds like what you're looking for, see sections 3 and 5 of the paper. General ideas from the paper: Rijndael had a potentially lower security margin than Twofish and Serpent. Rijndael had better performance ...

8

The final report is here http://csrc.nist.gov/archive/aes/index.html. All five finalists had at least adequate security on all accounts studied during the process, but Rijndael had better performance characteristics in both software and firmware on other hardware than 32 bit processors, compared to the other finalists.

7

The reason it is taking 4 32-bit integers into the round function is because it IS a bitsliced implementation. It bitsclices 32 4-bit sboxes into 4 32-bit inputs and uses standard logical operations on the words to get the job done. The sbox you posted was not generated by Osvik, but he generated a set of optimized blitsliced sboxes for 32-bit ...

7

Serpent uses 8 different 4-bit S-boxes (i.e. each S-box contains 16 elements) a total of 32 times. There are no "rows" or "columns" as it is a one-dimensional array containing a derangement of 16 elements. For each S-box, a 4-bit integer from 0 to 15 is mapped to another 4-bit integer from 0 to 15. When implementing the S-box as an array, the input is used ...

6

I don't think it's a bad idea - neither does Bruce Schneier. In his book Applied Cryptography, there is a section called "Cascading Multiple Block Algorithms". He basically states that provided that two distinct algorithms and two independent keys are used, then the result should be at least as difficult to break as the strongest algorithm. If Alice and ...

4

During the end of the contest the twofish team published a paper with their analysis where they discuss their thoughts and beliefs of what should happen. Futhermore they discuss the speed security tradeoff. Keep in mind this is a bit ago during the actual AES competition.

4

Welcome to the site! I'll try and give the general answer you're looking for: When NIST ran the AES competition in 1997 - 2000 to select the best symmetric cipher, they were looking for an algorithm that was well-balanced across a range of uses. The winner was the Rijndael cipher, which we now simply call AES. AES: the Advanced Encryption Standard ...

4

Of those you listed, AES is the best to study. Not only is it the standard that is used everywhere, it has a huge literature of people explaining it and analyzing it, far larger than any of the others on your list. Also, compared to the others on your list it is easier to understand why AES strongly resists certain major classes of attack (like linear and ...

4

First, it is important to learn the basics behind all symmetric ciphers. You can get this from Handbook of Applied Cryptography, see Chapter 7, especially 7.1, 7.2, 7.3. If you understand those three sections, you will be off on the right foot. From there, I would suggest just diving right into AES. It isn't that terribly difficult (yes, there are easier ...

4

Yes, in case of VeraCrypt there is a difference, but it is negligible in practice. First we need to consider how VeraCrypt actually performs the cascading of the encryption algorithms which is (literally) a block-wise chaining. E.g.: $$C=E_{XTS}^{1}(E_{XTS}^{2}(E_{XTS}^{3}(M)))$$ where each $E$ is a block cipher run in XTS mode and all using the same XTS ...

3

No, there is no mathematical proof to conclusively prove that Serpent and Twofish are stronger. The newer processors (intel, AMD, and even processors used in phones) have hardware instructions for AES, which apart from making AES much faster than the other two, defends against all kinds of side channel attacks (timing attacks, power consumption analysis etc)....

3

To answer your questions in order: You won't find test vectors for the s-boxes in the submission - the s-box functions are implementation specific optimisations, especially the bit-sliced s-box functions like the Osvik and Gladman/Simpson, which actually compute multiple s-box lookups in parallel. If you need to test your s-box implementations, I would take ...

3

Important Change, 23rd November 2015 Please see: http://www.bouncycastle.org/jira/browse/BMA-52 Okay, originally I answered saying we were doing the right thing, however, when the BC project approached the Serpent authors in 2009 it appears there was a breakdown in communication. We have just been told that the NESSIE vectors are in fact the correct ones. ...

3

Bouncy Castle seems to be using a reversed byte order for inputs and outputs when compared to NESSIE test vectors. In order to replicate the NESSIE vector in Bouncy Castle, the order of all inputs and outputs needs to be flipped at the byte level, therefore the following results are given from a NESSIE compliant implementation (Set 1, Vector 120): key = ...

3

An adversary would have to first break the first scheme and then the second, so in concrete terms there is slightly added security.If it takes time $2^{80}$ to break each scheme independently, it now takes time $2^{81}$ to break both encryptions. So there is minimal added security. In computational terms, assuming the key-size are similar, this wouldn't add ...

3

Your first option: Encrypted(Input) = AES256(key2, Serpent(key1, Input)) suffers from a textbook meet-in-the-middle attack. It only gives you one additional bit of security over AES alone / Serpent alone. Not a good choice if you're aiming for extra paranoia.

3

It really depends on what sort of break AES would suffer. The primary issue with DES was that it's key length was too small (56-bits). Multiple encryption can help here because it increases the effective key length of the whole operation. The meet-in-the-middle attack on DES takes about 2^112 operations, which is infeasible to brute force anytime soon. AES ...

3

Yes, Serpent also does a deterministic well-known key expansion. So it should be possible to identify the sub keys in memory. You will want to know what implementation you are looking for since there is more than one sensible order for the key material to be in.

2

Block ciphers are already built of multiple components: AES = fixed 8-bit sbox, MDS matrix multiplication, 8-bit rotations Twofish = key dependent sboxes, MDS matrix, 1 and 8-bit rotations, PHT Chaining ciphers adds more components, more rounds, more complexity Depending on chaining implementation, a different IV is not required for each cipher. For ...

2

You say I have never studied a cipher before In that case I would recommend the following: Sign up for the Stanford online class on Cryptography on Coursera. This is a great introduction to Cryptography and this will conver block ciphers. Get a library card with your local public library and ask them to get some textbooks on Cryptography for you. There ...

2

I want to know how strong any cipher, specifically Serpent, is in CTR mode. CTR mode has a security proof. When you use it right (no nonce collisions, etc.) and with a secure block cipher (full Serpent has not been attacked), it will give you confidentiality. OMAC is a MAC algorithm, or a pair of them actually, which is meant to authenticate the message, ...

2

Any block cipher within CTR operates the same way; CTR security is only dependent on the block size. Serpent was one of the candidates to become AES. It is thought to have a high security margin (and no weak keys etc). None of the currently known attacks seem to have done much damage to the security claims. All AES candidates have a block size of 128 bit ...

2

Here are quotes from Cryptography Engineering: Design Principles and Practical Applications (Niels Ferguson, Bruce Schneier, Tadayoshi Kohno) : Serpent [...] is built like a tank. Easily the most conservative of all the AES submissions, Serpent is in many ways the opposite of AES. Whereas AES puts emphasis on elegance and efficiency, Serpent is ...

2

This question can be generalized to the question why ciphers should be quick. There are several reason why encryption/decryption needs to be quick even today: Faster to implement aka (easier to implement): the easier it is to implement, the less likely it is for an developer to make an mistake when implementing the cipher for a given system and thus ...

Only top voted, non community-wiki answers of a minimum length are eligible