Security - Telenor

The deadline for submitting candidates to the AES
was June 15, 1998. Out of a total of 21 submissions,
six were discarded because of incomplete
documentation. Of the remaining 15, five are from
the USA, two from Canada, there is one candidate
each from Australia, Belgium, Costa Rica, France,
Japan, Korea, and Germany, and then a multinational
candidate from Denmark, United Kingdom
and Israel. This author represents the Scandinavian
colours in this competition.
After one year of gathering information about
the 15 candidates NIST decided in August 1999
to pick five candidates for a final and last round.
This author was involved in the breaking of two
of the 15 candidates and in the finding of serious
weaknesses in a third candidate. The five candidates
for the final round are in alphabetical
order.
• MARS by IBM, USA;
• RC6 by RSA Inc., USA;
• Rijndael by researchers from Belgium;
• Serpent by researchers from Denmark, UK,
Israel;
• Twofish by Counterpane, USA.
In April 2000 the last conference on the AES
took place in New York, USA, and May 15,
2000 was the deadline for sending in comments
and analysis of the five candidates. NIST expects
to announce the winner(s) some time in
the year 2000.
Serpent
Serpent is a snake; the idea is that Serpent will
slither away from all cryptanalytic attacks. My
co-authors on Serpent are Ross Anderson from
Cambridge University in England and Eli Biham
from Technion University in Haifa, Israel. The
first version of Serpent (later called Serpent-0)
was developed in 1997 and presented at a conference
on encryption in Paris, March 1998. The
version we submitted to NIST, called Serpent, is
a slightly modified version of Serpent-0. Today
(July 2000) no one has managed to find any
weaknesses of any kind in Serpent.
Secret-key cryptosystems are traditionally constructed
by running the message through several
so-called substitutions and permutations dependent
on the value of the secret key. Substitutions
are also sometimes called S-boxes and are often
implemented in terms of a look-up table, which
for every input specifies the function value. The
advantage of this approach is that it is relatively
easy to choose and use functions with complex
mathematical formulae. Permutations are often
simple functions which permute (or re-order) the
bits of the messages typically, one uses a set of
small substitutions each modifying a small piece
of the message, but such that the whole text is
modified. Subsequently, the pieces are moved
Telektronikk 3.2000
around and mixed. This recipe is then repeated a
sufficient number of times, until the resulting
ciphertext looks like total gibberish (and often
more than that).
Serpent is constructed as above and has 32 iterations
or layers. In each layer the 128-bit text is
split into 32 smaller parts of four bits each. The
four bits are input to a small S-box, which again
returns four (other bits). Then the 32 blocks of
four bits are concatenated (put together) and the
128 bits are mixed using a permutation. The nice
feature of Serpent is that the 32 S-box evaluations
can be done in parallel. Most computers
today operate on 32-bit words, which enables us
to look up 32 S-box values in parallel; that is, on
computers with just one processor. This means
that the 32 look-ups are much faster than doing
32 conventional look-ups. On 8-bit processors
it is possible to do eight evaluations in parallel.
The substitutions and permutations are well chosen,
such that all known attacks on block cipher
have to give up after 7 to 9 layers. Therefore
there is a big safety margin in Serpent, big
enough to handle even considerable improvements
in the known techniques.
On the average PC Serpent is not the fastest
algorithm of the final five candidates left in the
competition. On the other hand, on other platforms,
e.g. in smart card applications, Serpent is
one of the fastest; also in hardware Serpent is the
fastest of the five. The great advantage of Serpent
is that the safety margin protecting against
future cryptanalytic improvements is the largest
of all five candidates.
Licenses?
One of the great properties of the AES, apart
from high security (if Serpent is chosen!) is that
the system must be royalty free and free to use
for everybody all over the world. It was a condition
to participate in the competition that all
patents and rights were waived, in case the algorithm
should be selected for the AES.
Hidden Trapdoors
One of the favourite subjects in the boulevard
press when it comes to encryption system is hidden
trapdoors. As an example, when the DES
was first published there was a lot of debate on
the possibility that the American government
had put in a trapdoor enabling them to read
encrypted traffic without knowing the secret
key. However, I am convinced that no such trapdoor
exists for the DES, and I guarantee that no
such trapdoors have been put into Serpent. It is
very hard to break the encryption systems which
are constructed according to the state-of-the-art,
but it is even more difficult in my opinion to put
a trapdoor into a public cryptosystem without
being detected.
11