Problem - Kevin Tafuro

tively new breed of block cipher that is far less understood than the traditional
underpinnings upon which Triple-DES is based. *
Nonetheless, AES is widely believed to be able to resist any practical attack currently
known that could be launched against any block cipher. Today, many cryptographers
would feel just as safe using AES as they would using Triple-DES. In addition,
AES always uses longer effective keys and is capable of key sizes up to 256 bits,
which should offer vastly more security than Triple-DES, with its effective 112-bit
keys. † (The actual key length can be either 128 or 192 bits, but not all of the bits
have an impact on security.) DES itself is, for all intents and purposes, insecure
because of its short key length. Finally, AES is faster than DES, and much faster than
Triple-DES.
Serpent is a block cipher that has received significant scrutiny and is believed to have
a higher security margin than AES. Some cryptographers worry that AES may be easy
to break in 5 to 10 years because of its nontraditional nature and its simple algebraic
structure. Serpent is significantly more conservative in every way, but it is slower.
Nonetheless, it’s at least three times faster than Triple-DES and is more than fast
enough for all practical purposes.
Of course, because AES is a standard, you won’t lose your job if AES turns out to be
broken, whereas you’ll probably get in trouble if Serpent someday falls!
RC4 is the only widely used stream cipher. It is quite fast but difficult to use properly,
because of a major weakness in initialization (when using a key to initialize the
cipher). In addition, while there is no known practical attack against RC4, there are
some theoretical problems that show this algorithm to be far from optimal. In particular,
RC4’s output is fairly easy to distinguish from a true random generator, which
is a bad sign. (See Recipe 5.23 for information on how to use RC4 securely.)
SNOW is a new stream cipher that makes significant improvements on old principles.
Besides the fact that it’s likely to be more secure than RC4, it is also faster—an
optimized C version runs nearly twice as fast for us than does a good, optimized
assembly implementation of RC4. It has also received a fair amount of scrutiny,
though not nearly as much as AES. Nothing significant has been found in it, and even
the minor theoretical issues in the first version were fixed, resulting in SNOW 2.0.
Table 5-1 shows some of the fastest noncommercial implementations for popular
patent-free algorithms we could find and run on our own x86-based hardware.
(There may, of course, be faster implementations out there.) Generally, the implementations
were optimized assembly. Speeds are measured in cycles per byte for the
* Most block ciphers are known as Feistel ciphers, a construction style dating back to the early 1970s. AES is
a Square cipher, which is a new style of block cipher construction, dating only to 1997.
† This assumes that a meet-in-the-middle attack is practical. Otherwise, the effective strength is 168 bits. In
practice, even 112 bits is enough.
158 | Chapter 5: Symmetric Encryption
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.