Evaluation Criteria for AES
1. Why NIST Replaced DES (1997 Call)
By 1997 DES's 56-bit key was demonstrably broken (EFF Deep Crack coming) and 3DES too slow as a stopgap. NIST issued an open international competition (not a secret NSA design like DES): any team could submit a 128-bit-block cipher with 128/192/256-bit keys, royalty-free, secure + fast in hardware AND software. 15 candidates (1998) → 5 finalists (MARS, RC6, Rijndael, Serpent, Twofish) → Rijndael winner (Oct 2000, FIPS-197 in 2001).
2. The Three Evaluation Pillars (Memorize)
| Pillar | What NIST Measured | Examples |
|---|---|---|
| Security | Resistance to differential, linear, related-key, interpolation, Square attacks; sound math; random-looking output; margin above break | Rijndael wide-trail bounds; Serpent most conservative (32 rounds); RC6 too new/analysis thin |
| Cost | Speed (Mbps, cycles/byte) on 32-bit CPUs, 8-bit smart cards, FPGA/ASIC gates; memory (RAM/ROM); key-setup time | Rijndael ~fast everywhere + tiny tables; Serpent slow in software (bitslice); MARS heavy gates |
| Algorithm characteristics | Flexibility (key/block sizes, parameters), simplicity/elegance, suitability for hardware + smart cards + software, no patent/royalty issues | Rijndael clean SPN, any key length; Twofish complex key schedule; MARS heterogeneous rounds hurt analysis |
Security first, then cost among secure candidates, then elegance as tiebreak.
3. Finalist Scorecard (Exam Favourite)
| Finalist | Type | Security margin | Speed issue | Verdict |
|---|---|---|---|---|
| Rijndael (Daemen–Rijmen) | SPN, inversion | Provable wide-trail bounds | Fast everywhere, low RAM | Winner — best balance |
| Serpent (Anderson–Biham–Knudsen) | SPN, 32 rounds | Highest margin (overkill) | Slow software, fast bitslice HW | Runner-up — too slow |
| Twofish (Schneier et al.) | Feistel, key-dependent S-boxes | Good margin | Fast software, complex schedule | Strong but complex |
| MARS (IBM) | Heterogeneous Feistel | Hard to analyze (mixed ops) | Big HW area | Rejected — inelegant |
| RC6 (Rivest et al.) | Feistel + data-dependent rotations | Thinnest analysis, some certificational attacks | Fastest software | Rejected — margin doubts |
4. Security Evaluation Details (What "Secure" Meant)
- Classical attacks: all finalists resisted differential/linear at full rounds; reduced-round breaks measured margin (Rijndael: 4 rounds provably bounded, 10+ actual → 2.5× margin).
- New attacks: Square/integral attack (discovered on Square, Rijndael's ancestor) broke 6–7 rounds — full 10–14 safe; related-key on 192/256 noted later (2009, — certificational, not practical).
- Statistical tests: Avalanche ( bits flip), bit-independence, key-Avalanche (1 key bit flips ciphertext) — all finalists passed; Rijndael cleanest proofs.
- Implementation security: side-channel ease noted — Rijndael table lookups later needed AES-NI/masked implementations (cache-timing attacks, 2005+).
Exam Points
- 1997 open-call story + 15 → 5 → Rijndael/FIPS-197 — 2-mark opener.
- Three pillars (security, cost, characteristics) with one line each — 5-mark core.
- Finalist table with winner rationale ("best balance, provable bounds, fast everywhere") — favourite 5-marker.
- Margin concept: reduced-round breaks vs full-round safety + Square-attack footnote.