# Tag Info

21

TL;DR: Twofish and Treefish are fine. It is not the best idea to have the cipher you want to use hardcoded because you can't upgrade easily when one of them is broken. to quote mikeazo in the comments: What you should do is develop your application to not be bound to a specific cipher. Twofish In 1999, Niels Ferguson published an impossible ...

15

None of Twofish, Serpent and AES are currently known as broken, so as far as security is concerned, you can use any of them. AES has a slight advantage because it's very widely used, so if it gets broken you're more likely to hear about it and get relevant software updates quickly. The Snowden postings haven't changed much as far as cryptography usage is ...

11

The combination between addition modulo $2^{32}$ (not modulo $32 = 2^5$) - indicated by $\boxplus$ in the diagram - and XOR (i.e. bitwise addition modulo $2$) - indicated by $\oplus$ - makes the algorithm more non-linear. Each of them for itself is a linear operation, but over different groups (addition in $GF(2^{32})$ vs. addition in $Z/2^{32})$, and the ...

9

If you want to choose a fishy cipher by Bruce et al, I'd go for Twofish. Reason: Blowfish is not recommended anymore because of the small block size of 64 bits, among others. Even Bruce is not recommending it anymore - it's an old but unbroken cipher; Twofish is a relatively modern 128 bit block cipher which is a drop in for AES - for the simple reason ...

9

SHORT: This is kind of true. However, things are bit different now. Better protection against brute force is inaccurate claim. At the time Rijndael (AES) won the competition, it was faster, and sufficiently strong. After the competition, Rijndael (AES) has gotten faster (AES-NI and other hardware improvements). Also Rijndael (AES) has also gotten ...

9

Serpent is straightforward to implement with side-channel resistance due to the bit-sliced design. Because AES incorporates an S-Box that is most simply implemented as a lookup table, implementations of it tend to be prone to side-channel attacks. Threefish was designed for the SHA-3 competition, and was intended to be a part of a sort of package of ...

8

I can see based upon your question that you're not already a crypto-expert. Given that, I think the single most useful answer I can give you is this: Multiple encryption addresses a problem that mostly doesn't exist. Modern ciphers rarely get broken -- at least, not in the Swordfish sense. You're far more likely to get hit by malware or an implementation ...

8

During the final round of the AES contest, NIST issued a summary of the 5 finalists on the topics of security, speed, implementation, and such. That sounds like what you're looking for, see sections 3 and 5 of the paper. General ideas from the paper: Rijndael had a potentially lower security margin than Twofish and Serpent. Rijndael had better performance ...

8

The final report is here http://csrc.nist.gov/archive/aes/index.html. All five finalists had at least adequate security on all accounts studied during the process, but Rijndael had better performance characteristics in both software and firmware on other hardware than 32 bit processors, compared to the other finalists.

8

So I heard that Twofish is much more secure than AES, because it is not vulnerable to bruteforce and only supports 256 bit . Neither AES nor Twofish is vulnerable to brute force attack on the key in practical scenarios. Both support key sizes of 128, 192, and 256 bits, which makes them equally resistant to brute force attack. Also I heard that is not ...

6

When would-be pseudorandom data fails a randomness test, the reasons are of the following kinds (from most to least common in my experience) The data is generated by a method not supposed to yield pseudorandom data. The test was incorrectly applied. A strike of bad luck: randomness tests are supposed to fail when given truly random data, with probability ...

5

Rijndael (aka AES) and Twofish were both candidates and finalists for the Advanced Encryption Standard contest, a three year selection process which yielded the selection of Rijndael as the standard. Contest submissions were required to be block ciphers of block size 128 bits and support key sizes of 128,192 and 256 bits. Submissions were put through rounds ...

5

In practice, because they will target the easiest/weakest/least expensive link in the chain, they would attack you. It is infinitely easier to threaten to crack someone's kneecaps to obtain their password then to crack an AES key. Supposing they wanted to attack the cryptography specifically, for practice or fun, they would probably extract the key via a ...

5

I'm tailoring my question specifically to VeraCrypt where needed. So if We have AES(Twofish)) with the key : Test-password123 The "Test-pass" Part would be used for AES and the "word123" part gor twofish right ? No. VeraCrypt (and any other somewhat decent encryption program for that matter) uses a so-called "password-based key derivation function" (...

5

Well, to figure out this sort of thing, it's easier if we work backwards. So, we start at the back (the fact that we can store up to 512 characters in a database field), and consider how much binary data we can store. Well, base-4 takes 3 bytes of binary data, and encodes it in 4 bytes of base-64. Thus, we can store 3*(512/4) = 384 bytes of binary ...

4

In order for a symmetric block cipher to be considered secure by modern standards, it has to be IND-CPA, that is indistinguishable from a random oracle under a chosen plain text attack. It also has to be IND-CCA and IND-CCA2, but IND-CPA is sufficient for it to also be secure under a known plain text attack. Presuming TwoFish is still unbroken, it should ...

4

During the end of the contest the twofish team published a paper with their analysis where they discuss their thoughts and beliefs of what should happen. Futhermore they discuss the speed security tradeoff. Keep in mind this is a bit ago during the actual AES competition.

4

Yes, in case of VeraCrypt there is a difference, but it is negligible in practice. First we need to consider how VeraCrypt actually performs the cascading of the encryption algorithms which is (literally) a block-wise chaining. E.g.: $$C=E_{XTS}^{1}(E_{XTS}^{2}(E_{XTS}^{3}(M)))$$ where each $E$ is a block cipher run in XTS mode and all using the same XTS ...

4

Of those you listed, AES is the best to study. Not only is it the standard that is used everywhere, it has a huge literature of people explaining it and analyzing it, far larger than any of the others on your list. Also, compared to the others on your list it is easier to understand why AES strongly resists certain major classes of attack (like linear and ...

4

First, it is important to learn the basics behind all symmetric ciphers. You can get this from Handbook of Applied Cryptography, see Chapter 7, especially 7.1, 7.2, 7.3. If you understand those three sections, you will be off on the right foot. From there, I would suggest just diving right into AES. It isn't that terribly difficult (yes, there are easier ...

4

Welcome to the site! I'll try and give the general answer you're looking for: When NIST ran the AES competition in 1997 - 2000 to select the best symmetric cipher, they were looking for an algorithm that was well-balanced across a range of uses. The winner was the Rijndael cipher, which we now simply call AES. AES: the Advanced Encryption Standard ...

3

No, there is no mathematical proof to conclusively prove that Serpent and Twofish are stronger. The newer processors (intel, AMD, and even processors used in phones) have hardware instructions for AES, which apart from making AES much faster than the other two, defends against all kinds of side channel attacks (timing attacks, power consumption analysis etc)....

3

I'm not sure about your definition, so let's take branch number in terms of the byte-wise differential branch number, i.e. the branch number of a function $F(x)$ is $$\mathcal{B}_{F(x)} = \min_{a,b \neq a}\{ w(a \oplus b) + w(F(a) \oplus F(b))\}$$ where $w(x)$ is the number of non-zero bytes in $x$. In this case, the branch number of the Twofish round ...

3

Just use AES. It's hardware-accelerated and implementations have had ages to have flaws discovered and patched. More strongly, just use GPG to encrypt data at rest and just use TLS (>= 1.2, with appropriate AEAD ciphers) for data in motion. "If you're typing the letters A-E-S into your code, you're doing it wrong." Anything you build yourself is infinitely ...

3

Well, it turns out that, both from a security and a performance standpoint, it doesn't really matter. From a security standpoint, the goal (which, as far as we know, Twofish achieves) is that if you know all but N bits of the key, it still takes about $2^N$ trial decrypts to recover the remaining bits. So, it doesn't matter if you have a 128 bit Twofish ...

3

Should you pick AES, Twofish, AES(Twofish) or Twofish(AES)? You should pick AES. Also if you should choose Twofish, is it post-quantum computer algorithm proof? There's no current publicly known attack that breaks Twofish any faster than Grover's algorithm (using quantum computers), so it is as secure as AES in that regard. However it is likely much ...

3

In most cases, you should probably use AES, especially if there is hardware support. In some cases, it might make sense to use one of the others. For example, the simplicity of Threefish would make sense for an embedded controller using a micro lacking hardware support for AES. Its lack of S-Boxes reduces the amount of ROM needed. If you don't need the ...

3

Yes, Serpent also does a deterministic well-known key expansion. So it should be possible to identify the sub keys in memory. You will want to know what implementation you are looking for since there is more than one sensible order for the key material to be in.

2

Block ciphers are already built of multiple components: AES = fixed 8-bit sbox, MDS matrix multiplication, 8-bit rotations Twofish = key dependent sboxes, MDS matrix, 1 and 8-bit rotations, PHT Chaining ciphers adds more components, more rounds, more complexity Depending on chaining implementation, a different IV is not required for each cipher. For ...

2

You say I have never studied a cipher before In that case I would recommend the following: Sign up for the Stanford online class on Cryptography on Coursera. This is a great introduction to Cryptography and this will conver block ciphers. Get a library card with your local public library and ask them to get some textbooks on Cryptography for you. There ...

Only top voted, non community-wiki answers of a minimum length are eligible