Editing Advanced Encryption Standard process

{{Use American English|date = March 2019}}
{{Short description|Process of developing the AES standard}}
{{Use mdy dates|date = March 2019}}

The [[Advanced Encryption Standard]] (AES), the symmetric [[block cipher]] ratified as a standard by [[National Institute of Standards and Technology]] of the United States (NIST), was chosen using a process lasting from 1997 to 2000 that was markedly more open and transparent than its predecessor, the [[Data Encryption Standard]] (DES). This process won praise from the open cryptographic community, and helped to increase confidence in the security of the winning algorithm from those who were suspicious of backdoors in the predecessor, DES.

A new standard was needed primarily because DES had a relatively small 56-bit key which was becoming vulnerable to [[brute-force attack]]s. In addition, the DES was designed primarily for hardware and was relatively slow when implemented in software.<ref>{{cite web |title=cryptology:: The Data Encryption Standard and the Advanced Encryption Standard |url=http://www.britannica.com/EBchecked/topic/145058/cryptology/233467/The-Data-Encryption-Standard-and-the-Advanced-Encryption-Standard |website=Britannica.com |access-date=2018-10-09 |archive-url=https://web.archive.org/web/20140514013110/http://www.britannica.com/EBchecked/topic/145058/cryptology/233467/The-Data-Encryption-Standard-and-the-Advanced-Encryption-Standard |archive-date=2014-05-14}}</ref> While Triple-DES avoids the problem of a small key size, it is very slow even in hardware, it is unsuitable for limited-resource platforms, and it may be affected by potential security issues connected with the (today comparatively small) block size of 64 bits.

==Start of the process==
On January 2, 1997, NIST announced that they wished to choose a successor to DES to be known as AES. Like DES, this was to be "an unclassified, publicly disclosed encryption algorithm capable of protecting sensitive government information well into the next century."<ref>{{Cite web |url=https://csrc.nist.gov/news/1997/announcing-development-of-fips-for-advanced-encryp |title=Announcing Development of a Federal Information Processing Standard for Advanced Encryption Standard |date=1992-01-02 |website=csrc.nist.gov |access-date=2018-10-09}}</ref> However, rather than simply publishing a successor, NIST asked for input from interested parties on how the successor should be chosen. Interest from the open cryptographic community was immediately intense, and NIST received a great many submissions during the three-month comment period.

The result of this feedback was a call for new algorithms on September 12, 1997.<ref>{{cite web |title=Requesting Candidate Algorithm Nominations for AES |url=https://csrc.nist.gov/news/1997/requesting-candidate-algorithm-nominations-for-aes |website=csrc.nist.gov |access-date=2018-10-09 |date=1997-09-12}}</ref> The algorithms were all to be block ciphers, supporting a block size of 128 bits and key sizes of 128, 192, and 256 bits. Such ciphers were rare at the time of the announcement; the best known was probably [[Square (cipher)|Square]].

==Rounds one, two, and three==
In the nine months that followed, fifteen designs were created and submitted from several countries. They were, in alphabetical order: [[CAST-256]], [[CRYPTON]], [[DEAL]], [[DFC_(cipher)|DFC]], [[E2_(cipher)|E2]], [[FROG]], [[Hasty_Pudding_cipher|HPC]], [[LOKI97]], [[MAGENTA]], [[MARS_(cipher)|MARS]], [[RC6]], [[Advanced_Encryption_Standard|Rijndael]], [[Secure and Fast Encryption Routine|SAFER+]], [[Serpent_(cipher)|Serpent]], and [[Twofish]].

In the ensuing debate, many advantages and disadvantages of the candidates were investigated by cryptographers; they were assessed not only on security, but also on performance in a variety of settings (PCs of various architectures, smart cards, hardware implementations) and on their feasibility in limited environments (smart cards with very limited memory, low gate count implementations, FPGAs).

Some designs fell due to [[cryptanalysis]] that ranged from minor flaws to significant attacks, while others lost favour due to poor performance in various environments or through having little to offer over other candidates. NIST held two conferences to discuss the submissions (AES1, August 1998 and AES2, March 1999<ref>{{cite web |last1=Georgoudis |first1=Dianelos |title=Live from the Second AES Conference, day 1 |url=http://cryptome.org/jya/aes2-day1.htm |website=Cryptome |access-date=7 April 2019}}</ref><ref>{{cite web |last1=Georgoudis |first1=Dianelos |title=Live from the Second AES Conference, day 2 |url=http://cryptome.org/jya/aes2-day2.htm |website=Cryptome |access-date=7 April 2019}}</ref><ref>{{cite web |last1=Georgoudis |first1=Dianelos |title=Discussion about Second AES Conference|url=https://groups.google.com/forum/#!msg/sci.crypt/vkN8A7ens_8/gLDHOM6Vy9IJ |website=Google Groups|access-date=30 November 2019}}</ref>), and in August 1999 they announced<ref>{{cite web |title=AES Development - Cryptographic Standards and Guidelines |url=https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/archived-crypto-projects/aes-development |website=csrc.nist.gov |date=December 29, 2016 |access-date=2018-10-09}}</ref> that they were narrowing the field from fifteen to five: [[MARS (cryptography)|MARS]], [[RC6]], [[Rijndael]], [[Serpent (cipher)|Serpent]], and [[Twofish]]. All five algorithms, commonly referred to as "AES finalists", were designed by cryptographers considered well-known and respected in the community.
The AES2 conference votes were as follows:<ref>{{Cite web |date=2021 |title=Development of the Advanced Encryption Standard |url=https://nvlpubs.nist.gov/nistpubs/jres/126/jres.126.024.pdf |archive-url=https://web.archive.org/web/20210820003022/https://nvlpubs.nist.gov/nistpubs/jres/126/jres.126.024.pdf |archive-date=2021-08-20 |url-status=live |access-date=24 Nov 2023}}</ref>

*[[Rijndael]]: 77 positive, 1 negative
*[[RC6]]: 79 positive, 6 negative
*[[Twofish]]: 64 positive, 3 negative
*[[MARS (cryptography)|MARS]]: 58 positive, 6 negative
*[[Serpent (cipher)|Serpent]]: 52 positive, 7 negative
*[[E2 (cipher)|E2]]: 27 positive, 13 negative
*[[CAST-256]]: 16 positive, 18 negative
*[[Secure and Fast Encryption Routine|SAFER+]]: 20 positive, 24 negative
*[[DFC (cipher)|DFC]]: 22 positive, 27 negative
*[[CRYPTON|Crypton]]: 16 positive, 31 negative
*[[DEAL]]: 1 positive, 71 negative
*[[Hasty Pudding cipher|HPC]]: 1 positive, 78 negative
*[[MAGENTA]]: 1 positive, 84 negative
*[[FROG|Frog]]: 1 positive, 86 negative
*[[LOKI97]]: 1 positive, 86 negative

A further round of intense analysis and cryptanalysis followed, culminating in the AES3 conference in April 2000, at which a representative of each of the final five teams made a presentation arguing why their design should be chosen as the AES. The AES3 conference votes were as follows:<ref>{{Cite web |date=April 28, 2000 |title=AES3 Conference Feedback Form - Summary |url=https://csrc.nist.rip/encryption/aes/round2/conf3/AES3FeedbackForm-summary.pdf |archive-url=https://web.archive.org/web/20231124173420/https://csrc.nist.rip/encryption/aes/round2/conf3/AES3FeedbackForm-summary.pdf |archive-date=2023-11-24 |url-status=live |access-date=24 Nov 2023}}</ref>

*[[Rijndael]]: 86 positive, 10 negative
*[[Serpent (cipher)|Serpent]]: 59 positive, 7 negative
*[[Twofish]]: 31 positive, 21 negative
*[[RC6]]: 23 positive, 37 negative
*[[MARS (cryptography)|MARS]]: 13 positive, 84 negative

==Selection of the winner==
On October 2, 2000, NIST announced<ref>{{cite web |last1=Swenson |first1=Gayle |title=Commerce Department Announces Winner of Global Information Security Competition |url=https://www.nist.gov/news-events/news/2000/10/commerce-department-announces-winner-global-information-security |website=NIST |access-date=2018-10-09 |date=2000-10-02}}</ref> that [[Rijndael]] had been selected as the proposed AES and started the process of making it the official standard by publishing an announcement in the [[Federal Register]]<ref>{{cite journal |author1=NIST |title=Announcing Draft Federal Information Processing Standard (FIPS) for the Advanced Encryption Standard (AES) and Request for Comments |journal=Federal Register |date=2001-02-28 |volume=66 |page=12762 |url=https://www.gpo.gov/fdsys/pkg/FR-2001-02-28/pdf/01-4886.pdf |archive-url=https://web.archive.org/web/20121022083448/http://www.gpo.gov/fdsys/pkg/FR-2001-02-28/pdf/01-4886.pdf |archive-date=2012-10-22 |url-status=live |access-date=2018-10-09}}</ref> on February 28, 2001 for the draft FIPS to solicit comments. On November 26, 2001, NIST announced that [[Advanced Encryption Standard|AES]] was approved as [[Federal Information Processing Standard|FIPS PUB]] 197.

NIST won praises from the cryptographic community for the openness and care with which they ran the standards process. [[Bruce Schneier]], one of the authors of the losing Twofish algorithm, wrote after the competition was over that "I have nothing but good things to say about NIST and the AES process."<ref>{{cite web |title=Crypto-Gram: October 15, 2000 - Schneier on Security |url=http://www.schneier.com/crypto-gram-0010.html#8 |website=www.schneier.com |access-date=2018-10-09 |date=2000-10-15}}</ref>

==See also==

* [[CAESAR Competition]] – Competition to design authenticated encryption schemes

*[[NIST hash function competition]]
*[[Post-Quantum Cryptography Standardization]]

==References==
{{reflist}}

==External links==
*[http://csrc.nist.gov/archive/aes/ A historical overview of the process] can be found on [[NIST]]'s website.
*On the [[sci.crypt]] newsgroup, there are extensive discussions about the AES process.

{{Cryptography navbox|block}}

[[Category:Cryptography contests]]
[[Category:History of cryptography]]
[[Category:Advanced Encryption Standard]]
[[Category:National Institute of Standards and Technology]]