The Block Cipher Lounge - AES

(This page was last updated 13.09.99)

Name	Author(s)	Report(s)
MARS	IBM (11 authors)	"Tweak"
RC6	Rivest, Robshaw, Sidney, Yin	KM99
RIJNDAEL	Daemen, Rijmen	?
SERPENT	Anderson, Biham, Knudsen	?
TWOFISH	Schneier, Kelsey, Whiting, Wagner, Hall, Ferguson	MM99

Name	Author(s)	Rounds	Attack(s)
CAST-256	Adams	48	?
CRYPTON	Lim	12	C:32/56/32 (6) [DB99]
DEAL	Knudsen, Outerbridge	6,8	[Luc98] , [KS99]
DFC	Vaudenay et al	8	[KR99]
E2	Aoki, Kanda, Matsumoto, Moriai, Ohta, Ookubo, Takashima, Ueda	12	C:100/./. (8) [MT99]
FROG	Georgoudis, Leroux, Chaves	8	[W98]
Hasty Pudding	R. Schroeppel	8	?
LOKI97	Brown, Pieprzyk	16	K:56/./., C:56/./., [RK98]
MARS	IBM	32	[Saar98]
Magenta	Deutsche Telekomm	6,8	[BBFKS]
RC6	Rivest, Robshaw, Sidney, Yin	20	?
RIJNDAEL	Daemen, Rijmen	10,12,14	?
SAFER+	Massey, Khachatrian, Kuregian	8,12,16	[KSW99]
SERPENT	Anderson, Biham, Knudsen	32	?
TWOFISH	Schneier, Kelsey, Whiting, Wagner, Hall, Ferguson	16	MM99

The notation of the table:
Name	Name of the block cipher
Author	Name of the designer
Rounds	the number of rounds of the cipher
Attack

	K:a/b/c denotes that the best known plaintext attack requires 2^a plaintext/ciphertexts, has a workload of 2^b encryptions and requires 2^c words of memory.
	C:a/b/c denotes that the best chosen plaintext attack requires 2^a plaintext/ciphertexts, has a workload of 2^b encryptions and requires 2^c words of memory. A `.' means that this resource requirement is either negligible or unknown to us.
	(r): the number of rounds of the attack. If blank, r=Rounds
	[SA]: the paper describing the attack
	?: No attacks known

If you have some attacks on some of the ciphers here, or if you have comments to this page, please contact Lars or Vincent .

[BBFKS]: E. Biham, A. Biryukov, N. Ferguson, L. Knudsen, B. Schneier, A. Shamir, Cryptanalysis of MAGENTA

[IBM98]: Burwick, Coppersmith, D'Avignon, Gennaro, Halevi, Jutla, Matyas Jr., O'Connor, Peyravian, Safford, Zunic, ``MARS - a candidate cipher for AES''

[DB99]: C. D'Halluin, G. Bijnens, V. Rijmen, B. Preneel, ``Attack on 6 rounds of Crypton,'' FSE'99, LNCS.

[GLC]: D. Georgoudis, D. Leroux, B.S. Chaves, ``The "FROG" Encryption Algorithm''

[KSW99]: J. Kelsey, B. Schneier, D. Wagner, ``Key schedule weaknesses in SAFER+''

[KS99]: J. Kelsey, B. Schneier, ``Key schedule cryptanalysis of DEAL'', SAC 99

[KR99AL]: L. Knudsen, V. Rijmen, ``On the Decorrelated Fast Cipher (DFC) and its theory,'' FSE'99, LNCS.

[MT99]: M. Matsui, T. Tokita, ``Cryptanalysis of a reduced version of the block cipher E2,'' FSE'99, LNCS.

[E2]: Nippon Telegraph and Telephone Corporation, ``The 128-Bit Block Cipher E2"''

[MM99]: F. Mirza, S. Murphy, ``An Observation on the Key Schedule of Twofish''

[RRSY]: R. Rivest, M.J.B. Robshaw, R. Sidney, Y.L. Yin, "The RC6 Block Cipher"

[TF98]: Schneier, Kelsey, Whiting, Wagner, Hall, Ferguson, ``Twofish: A 128-bit Block Cipher''

This page was created 15.06.97 by Lars R. Knudsen and Vincent Rijmen.

The page is maintained by Lars R. Knudsen and Vincent Rijmen .
All comments welcome