Advanced Encryption Standard - crypto for the next century
Jim Reavis
Network World on Security, 09/27/99
A big decision will be made sometime next year that will affect electronic commerce and the Internet well into the next century. It is the selection of the Advanced Encryption Standard, a successor to the venerable Data Encryption Standard encryption algorithm, which was developed by IBM in the 1970s. Although having served its purpose for 20 years, DES has begun to show its age, it was broken in less than 24 hours in a cracking contest earlier this year. It is hoped that the new algorithm will last that long or longer.
The AES is to be selected next year by the National Institute of Standards and Technology. From an initial list of 21 candidates, the five finalists have been selected: MARS, RC6, Rijndael, Serpent and Twofish. Three are from the U.S., one is from Belgium and one has team members from several countries. These developers are primarily competing for the glory of being selected - NIST is requiring that the selected entry agrees to forgo any royalties from the algorithm.
What is the significance of the new algorithm? When selected, the AES algorithm will be used by the U.S. government for encrypting all sensitive, nonclassified information as soon as possible. Because the federal government has basically migrated from being a developer of computer technologies to a massive consumer, AES will be integrated into commercial products being sold to the public and private sector alike. This will likely give AES the critical mass it needs to be the encryption technology integrated into computers large and small to secure e-commerce and financial transactions, as well as protecting the privacy of individual communications.
Although the strength of the algorithm, and its resistance to attack, is the primary selection criteria, speed and portability are also critical. NIST has specified that the algorithm be successfully implemented on an Intel Pentium processor. While it may seem odd that the algorithm of the future needs to run on the hardware of the past, the vision is that this encryption needs to work on nontraditional devices, such as smart cards, where the resources are still predicted to be modest for a while. In addition to extensive white papers about their algorithms, submitters were required to submit ANSI C and Java implementations of their algorithm for testing.
NIST wisely realizes the benefit of building trust in the selection process by making it as open as possible. NIST is encouraging comment from the public and the competitors to assist in the decision-making process. The submissions are publicly available on NIST's Web site, and the competitors have been busy trying to crack each other's code. One submitter likened the process to a demolition derby, although at this stage the finalists are all fairly strong and the final selection may look more like a beauty contest. What groups are behind these algorithms?
MARS: IBM developed MARS, which stands for multiplication, addition, rotation and substitution - an overview of how the algorithm works.
RC6: RSA Laboratories submitted RC6. The principal inventor is Ronald Rivest, a professor at MIT and the R in RSA.
Rijndae: Two researchers from Belgium developed: Joan Daeman and Vincent Rijmen.
Serpent: Researches from Britain, Norway and Israel developed Serpent.
Twofish: Counterpane Systems of Minneapolis submitted Twofish, which was invented by Bruce Schneier, author of Applied Cryptography.
The candidates are all preparing for the third AES conference next April, where a technical analysis of the finalists will be presented and opinions of the strongest candidates will be offered. The final selection will occur shortly afterwards. A final standard will be published in the summer of 2001, with commercial products becoming available in the years following. There have been some suggestions that NIST will select one of the non-U.S. entries to encourage international adoption of the standard. I feel that the open process used for the algorithm selection is helping to mitigate that as an issue, and it isn't likely to be highly weighted by NIST.
An interesting development during the research of code cracking is the finding that these codes could potentially be broken by a new method: power consumption. By a very sophisticated process of monitoring the power consumption of smart cards, researchers are able to break codes. This could possibly be remedied by developing hardware that can change the power consumption signature - more research is definitely needed here. Although many believe the new standard will last for 20 to 30 years, I personally shy away from any technology predictions in excess of five years. We will certainly see more attempts to find indirect attacks at code breaking such as the power consumption method, and there will need to be continuing work to develop additional armor for the core algorithm.
This process of the government working on the development of a standard-encryption algorithm in an atmosphere of openness, and showing a true spirit of cooperation with the private sector, is an example of government at its best. It would be nice to see the government take the same approach with encryption technology that is already available.
RELATED LINKS
Advanced Encryption Standard (AES) Development Effort
Encryption Teams Circle, Firing Away
New York Times, 9/9/99
AES Finalists named
Federal Computer Week, 9/9/99
U.S. committees approve encryption, other bills
Network World, 06/24/99
DES code cracked in record time
Network World, 01/20/99
Archive of Network World on Security newsletters
Network World Security Alert will keep you up to date on the latest security holes and patches, with daily updates from key vendors, security organizations and Network World reporters. See the latest dispatches from the security here.
