Hot answers tagged

16

None of Twofish, Serpent and AES are currently known as broken, so as far as security is concerned, you can use any of them. AES has a slight advantage because it's very widely used, so if it gets broken you're more likely to hear about it and get relevant software updates quickly. The Snowden postings haven't changed much as far as cryptography usage is ...


13

AES has fewer rounds than Serpent so AES should be faster. The number of rounds by itself is meaningless. Some ciphers have a few complex rounds and others have many simple rounds. See my answer to Why does SHA-1 have 80 rounds? for a related explanation. There is no speed decrease with bigger key size in Serpent while there is in AES. The performance ...


10

SHORT: This is kind of true. However, things are bit different now. Better protection against brute force is inaccurate claim. At the time Rijndael (AES) won the competition, it was faster, and sufficiently strong. After the competition, Rijndael (AES) has gotten faster (AES-NI and other hardware improvements). Also Rijndael (AES) has also gotten ...


9

Serpent is straightforward to implement with side-channel resistance due to the bit-sliced design. Because AES incorporates an S-Box that is most simply implemented as a lookup table, implementations of it tend to be prone to side-channel attacks. Threefish was designed for the SHA-3 competition, and was intended to be a part of a sort of package of ...


9

Slowing block ciphers by increasing the number of rounds is an idea that does not catch because Compared to 15 years ago, the volume of data routinely enciphered by a computer has grown much more than the frequency of its CPU (even multiplied by number of cores and IPC improvements). Hence speed of ciphers is more important than it ever was. Correspondingly,...


8

I can see based upon your question that you're not already a crypto-expert. Given that, I think the single most useful answer I can give you is this: Multiple encryption addresses a problem that mostly doesn't exist. Modern ciphers rarely get broken -- at least, not in the Swordfish sense. You're far more likely to get hit by malware or an implementation ...


7

The reason it is taking 4 32-bit integers into the round function is because it IS a bitsliced implementation. It bitsclices 32 4-bit sboxes into 4 32-bit inputs and uses standard logical operations on the words to get the job done. The sbox you posted was not generated by Osvik, but he generated a set of optimized blitsliced sboxes for 32-bit ...


7

Serpent uses 8 different 4-bit S-boxes (i.e. each S-box contains 16 elements) a total of 32 times. There are no "rows" or "columns" as it is a one-dimensional array containing a derangement of 16 elements. For each S-box, a 4-bit integer from 0 to 15 is mapped to another 4-bit integer from 0 to 15. When implementing the S-box as an array, ...


6

The number of rounds does not directly influence security; it depends at least as much on the complexity of those rounds. That said, it is possible to use the percentage of rounds for which there are attacks as an indication on how much crypt-analysis has advanced (disregarding those attacks that are worse than brute force, of course). One tricky thing with ...


5

Yes, in case of VeraCrypt there is a difference, but it is negligible in practice. First we need to consider how VeraCrypt actually performs the cascading of the encryption algorithms which is (literally) a block-wise chaining. E.g.: $$C=E_{XTS}^{1}(E_{XTS}^{2}(E_{XTS}^{3}(M)))$$ where each $E$ is a block cipher run in XTS mode and all using the same XTS ...


4

Of those you listed, AES is the best to study. Not only is it the standard that is used everywhere, it has a huge literature of people explaining it and analyzing it, far larger than any of the others on your list. Also, compared to the others on your list it is easier to understand why AES strongly resists certain major classes of attack (like linear and ...


4

First, it is important to learn the basics behind all symmetric ciphers. You can get this from Handbook of Applied Cryptography, see Chapter 7, especially 7.1, 7.2, 7.3. If you understand those three sections, you will be off on the right foot. From there, I would suggest just diving right into AES. It isn't that terribly difficult (yes, there are easier ...


4

Welcome to the site! I'll try and give the general answer you're looking for: When NIST ran the AES competition in 1997 - 2000 to select the best symmetric cipher, they were looking for an algorithm that was well-balanced across a range of uses. The winner was the Rijndael cipher, which we now simply call AES. AES: the Advanced Encryption Standard The goal ...


4

Bouncy Castle seems to be using a reversed byte order for inputs and outputs when compared to NESSIE test vectors. In order to replicate the NESSIE vector in Bouncy Castle, the order of all inputs and outputs needs to be flipped at the byte level, therefore the following results are given from a NESSIE compliant implementation (Set 1, Vector 120): key = ...


4

Here are quotes from Cryptography Engineering: Design Principles and Practical Applications (Niels Ferguson, Bruce Schneier, Tadayoshi Kohno) : Serpent [...] is built like a tank. Easily the most conservative of all the AES submissions, Serpent is in many ways the opposite of AES. Whereas AES puts emphasis on elegance and efficiency, Serpent is ...


3

No, there is no mathematical proof to conclusively prove that Serpent and Twofish are stronger. The newer processors (intel, AMD, and even processors used in phones) have hardware instructions for AES, which apart from making AES much faster than the other two, defends against all kinds of side channel attacks (timing attacks, power consumption analysis etc)....


3

In most cases, you should probably use AES, especially if there is hardware support. In some cases, it might make sense to use one of the others. For example, the simplicity of Threefish would make sense for an embedded controller using a micro lacking hardware support for AES. Its lack of S-Boxes reduces the amount of ROM needed. If you don't need the ...


3

Yes, Serpent also does a deterministic well-known key expansion. So it should be possible to identify the sub keys in memory. You will want to know what implementation you are looking for since there is more than one sensible order for the key material to be in.


3

Important Change, 23rd November 2015 Please see: http://www.bouncycastle.org/jira/browse/BMA-52 Okay, originally I answered saying we were doing the right thing, however, when the BC project approached the Serpent authors in 2009 it appears there was a breakdown in communication. We have just been told that the NESSIE vectors are in fact the correct ones. ...


3

To answer your questions in order: You won't find test vectors for the s-boxes in the submission - the s-box functions are implementation specific optimisations, especially the bit-sliced s-box functions like the Osvik and Gladman/Simpson, which actually compute multiple s-box lookups in parallel. If you need to test your s-box implementations, I would take ...


2

Block ciphers are already built of multiple components: AES = fixed 8-bit sbox, MDS matrix multiplication, 8-bit rotations Twofish = key dependent sboxes, MDS matrix, 1 and 8-bit rotations, PHT Chaining ciphers adds more components, more rounds, more complexity Depending on chaining implementation, a different IV is not required for each cipher. For ...


2

I want to know how strong any cipher, specifically Serpent, is in CTR mode. CTR mode has a security proof. When you use it right (no nonce collisions, etc.) and with a secure block cipher (full Serpent has not been attacked), it will give you confidentiality. OMAC is a MAC algorithm, or a pair of them actually, which is meant to authenticate the message, ...


2

Any block cipher within CTR operates the same way; CTR security is only dependent on the block size. Serpent was one of the candidates to become AES. It is thought to have a high security margin (and no weak keys etc). None of the currently known attacks seem to have done much damage to the security claims. All AES candidates have a block size of 128 bit ...


2

Yes, it would be possible to identify Serpent or Twofish keys from round keys in memory, which are likely to exist in a software-only implementation optimized for speed (but not in hypothetical hardware implementations, and not necessarily in implementations optimized for RAM or code size). The Serpent round keys are 132 words of 32 bits, output by a ...


2

To check if it is a bitslice issue, we can look at a round output, this is round 1 from the example: 0000 0101 1111 1001 1111 1110 0101 1101 0101 0001 1010 0011 1011 1101 1111 1111 1001 1111 0000 1101 1110 1010 1100 0111 1010 1010 0111 0110 0011 0010 1010 1110 And yours: 0011 1101 0010 1111 1101 1110 1100 0011 0110 1111 1000 0111 0101 1011 0011 0001 0010 ...


2

You say I have never studied a cipher before In that case I would recommend the following: Sign up for the Stanford online class on Cryptography on Coursera. This is a great introduction to Cryptography and this will conver block ciphers. Get a library card with your local public library and ask them to get some textbooks on Cryptography for you. There ...


2

This question can be generalized to the question why ciphers should be quick. There are several reason why encryption/decryption needs to be quick even today: Faster to implement aka (easier to implement): the easier it is to implement, the less likely it is for an developer to make an mistake when implementing the cipher for a given system and thus ...


2

AES is the main block cipher in use today, standardized by NIST. Camellia is a Japanese standardized cipher. ChaCha is a fast stream cipher specified by Bernstein and incorporated into TLS with support from Google. Serpent and Twofish were AES last round candidates that didn't make it. Serpent is not that fast, and Twofish is relatively fast but not compared ...


2

This answer has 2 parts, the 1st on "quantifying" the security of unbroken ciphers, the 2nd on the choice of ciphers for different usage scenarios. If (on a scale of 1 to 10) AES is 5 and Serpent is 10, what would ChaCha be? First, you have to quantify their security in order for the scores to be meaningful. The quantification must have a basis, ...


1

What you would do in such a case is take a master key (which could be derived from a password) of a certain length (in your cases probably 128 or 256 bit long) and use a key derivation function (like HKDF) to derive three distinct keys of equal length which can be used in one algorithm each. This way, each of the encryption keys will have the same strength ...


Only top voted, non community-wiki answers of a minimum length are eligible