Efficiency in software: NIST-Specified platform 200 MHz Pentium pro, Borland C++ Speed Mbits/s 口128- bit key 30 ■192- bit key 256-bit key 25 20 15 10 Rijndael RC6 Twofish Mars Serpent
11 0 5 10 15 20 25 30 Rijndael RC6 Twofish Mars Serpent Efficiency in software: NIST-specified platform 128-bit key 192-bit key 256-bit key 200 MHz Pentium Pro, Borland C++ Speed [Mbits/s]
NIST Report: Security Security margin Serpent MARS Twofish Rijndael Adequate RC6 Simple Complex Complexity
12 Security Margin Complexity High Adequate Simple Complex NIST Report: Security Rijndael MARS Serpent Twofish RC6
Security: Theoretical attacks better than exhaustive key search S erpen 23 32 Twofish 10 16 Mars 516 without 16 mixing rounds Rijndael 310 RC6 15 520 05101520253035 of rounds in the attack/total of rounds
13 Security: Theoretical attacks better than exhaustive key search 0 5 10 15 20 25 30 35 Twofish Serpent Rijndael RC6 Mars without 16 mixing rounds # of rounds in the attack/total # of rounds 6 16 9 32 7 10 15 20 11 16 23 10 5 3 5
Security: Theoretical attacks better than exhaustive key search Serpent 28 72% Twofish 38 62%0 ars 69 31% Rijndael 70% 30% RC6 75% 25% 0102030405060708090100 of rounds in the attack/total of rounds. 100%/
14 0 10 20 30 40 50 60 70 80 90 100 Twofish Serpent Rijndael RC6 Mars Security: Theoretical attacks better than exhaustive key search # of rounds in the attack/total # of rounds 100% 28% 72% 38% 62% 69% 31% 70% 30% 75% 25%
AES: Types of candidate algorithms Feistel networks Modified feistel Network Twofish eal LOKI97 RC6 E2 DFC Magenta MARS CAST-256 Substitution Others Linear Transformation Networks Frog HPC Rijndael Safer+ Serpent Crypton 15
15 Feistel Networks Modified Feistel Network SubstitutionLinear Transformation Networks Others AES: Types of candidate algorithms Twofish E2 DFC Deal LOKI97 Magenta RC6 MARS CAST-256 Rijndael Serpent Safer+ Crypton Frog HPC