This page uses content from Wikipedia and is licensed under CC BY-SA.

Serpent's linear mixing stage | |

General | |
---|---|

Designers | Ross Anderson, Eli Biham, Lars Knudsen |

First published | 1998-08-21 |

Derived from | Square |

Certification | AES finalist |

Cipher detail | |

Key sizes | 128, 192 or 256 bits |

Block sizes | 128 bits |

Structure | Substitution–permutation network |

Rounds | 32 |

Best public cryptanalysis | |

All publicly known attacks are computationally infeasible, and none of them affect the full 32-round Serpent. A 2011 attack breaks 11 round Serpent (all key sizes) with 2^{116} known plaintexts, 2^{107.5} time and 2^{104} memory (as described in ^{[1]}).
The same paper also describes two attacks which break 12 rounds of Serpent-256. The first requires 2^{118} known plaintexts, 2^{228.8} time and 2^{228} memory. The other attack requires 2^{116} known plaintexts and 2^{121} memory but also requires 2^{237.5} time. |

**Serpent** is a symmetric key block cipher that was a finalist in the Advanced Encryption Standard (AES) contest, where it was ranked second to Rijndael. Serpent was designed by Ross Anderson, Eli Biham, and Lars Knudsen.

Like other AES submissions, Serpent has a block size of 128 bits and supports a key size of 128, 192 or 256 bits.^{[2]} The cipher is a 32-round substitution–permutation network operating on a block of four 32-bit words. Each round applies one of eight 4-bit to 4-bit S-boxes 32 times in parallel. Serpent was designed so that all operations can be executed in parallel, using 32 bit slices. This maximizes parallelism, but also allows use of the extensive cryptanalysis work performed on DES.

Serpent took a conservative approach to security, opting for a large security margin: the designers deemed 16 rounds to be sufficient against known types of attack, but specified 32 rounds as insurance against future discoveries in cryptanalysis. The official NIST report on AES competition classified Serpent as having a high security margin along with MARS and Twofish, in contrast to the adequate security margin of RC6 and Rijndael (currently AES).^{[3]} In final voting, Serpent had the least number of negative votes among the finalists, but scored second place overall because Rijndael had substantially more positive votes, the deciding factor being that Rijndael allowed for a far more efficient software implementation.^{[citation needed]}

The Serpent cipher algorithm is in the public domain and has not been patented.^{[4]} The reference code is public domain software and the optimized code is under GPL.^{[5]} There are no restrictions or encumbrances whatsoever regarding its use. As a result, anyone is free to incorporate Serpent in their software (or hardware implementations) without paying license fees.

Rijndael is a substitution-linear transformation network with ten, twelve, or fourteen rounds, depending on the key size, and with block sizes of 128 bits, 192 bits, or 256 bits, independently specified. Serpent is a substitution–permutation network which has thirty-two rounds, plus an initial and a final permutation to simplify an optimized implementation. The round function in Rijndael consists of three parts: a nonlinear layer, a linear mixing layer, and a key-mixing XOR layer. The round function in Serpent consists of key-mixing XOR, thirty-two parallel applications of the same 4×4 S-box, and a linear transformation, except in the last round, wherein another key-mixing XOR replaces the linear transformation. The nonlinear layer in Rijndael uses an 8×8 S-box whereas Serpent uses eight different 4×4 S-boxes. The 32 rounds means that Serpent has a higher security margin than Rijndael; however, Rijndael with 10 rounds is faster and easier to implement for small blocks.^{[6]} Hence, Rijndael was selected as the winner in the AES competition.

The original Serpent, Serpent-0, was presented at the 5th workshop on Fast Software Encryption, but a somewhat tweaked version, Serpent-1, was submitted to the AES competition. The AES submission paper discuss the changes, which include key scheduling differences.

The XSL attack, if effective, would weaken Serpent (though not as much as it would weaken Rijndael, which became AES). However, many cryptanalysts believe that once implementation considerations are taken into account the XSL attack would be more expensive than a brute force attack.^{[citation needed]}

In 2000, a paper by Kohno et al. presents a meet-in-the-middle attack against 6 of 32 rounds of Serpent and an amplified boomerang attack against 9 of 32 rounds in Serpent.^{[7]}

A 2001 attack by Eli Biham, Orr Dunkelman and Nathan Keller presents a linear cryptanalysis attack that breaks 10 of 32 rounds of Serpent-128 with 2^{118} known plaintexts and 2^{89} time, and 11 rounds of Serpent-192/256 with 2^{118} known plaintexts and 2^{187} time.^{[8]}

A 2009 paper has noticed that the nonlinear order of Serpent S-boxes were not 3 as was claimed by the designers.
^{[9]}

A 2011 attack by Hongjun Wu, Huaxiong Wang and Phuong Ha Nguyen, also using linear cryptanalysis, breaks 11 rounds of Serpent-128 with 2^{116} known plaintexts, 2^{107.5} time and 2^{104} memory.^{[1]}

The same paper also describes two attacks which break 12 rounds of Serpent-256. The first requires 2^{118} known plaintexts, 2^{228.8} time and 2^{228} memory. The other attack requires 2^{116} known plaintexts and 2^{121} memory but also requires 2^{237.5} time.

- Tiger – hash function by the same authors

- ^
^{a}^{b}Huaxiong Wang, Hongjun Wu & Phuong Ha Nguyen (2011). "Improving the Algorithm 2 in Multidimensional Linear Cryptanalysis" (PDF). ACISP 2011. doi:10.1007/978-3-642-22497-3_5. **^**Ross J. Anderson (2006-10-23). "Serpent: A Candidate Block Cipher for the Advanced Encryption Standard". University of Cambridge Computer Laboratory. Retrieved 2013-01-14.**^**NIST (2000),*Report on the Development of the Advanced Encryption Standard (AES)*(PDF), NIST**^**Serpent Holds the Key to Internet Security – Finalists in world-wide encryption competition announced (1999)**^**SERPENT – A Candidate Block Cipher for the Advanced Encryption Standard*"Serpent is now completely in the public domain, and we impose no restrictions on its use. This was announced on the 21st August at the First AES Candidate Conference. The optimised implementations in the submission package are now under the General Public License (GPL), although some comments in the code still say otherwise. You are welcome to use Serpent for any application. If you do use it, we would appreciate it if you would let us know!"*(1999)**^**Bruce Schneier; John Kelsey; Doug Whiting; David Wagner; Chris Hall. Niels Fergusonk; Tadayoshi Kohno; Mike Stay (2000). "The Twofish Team's Final Comments on AES Selection" (PDF).**^**Tadayoshi Kohno; John Kelsey & Bruce Schneier (2000). "Preliminary Cryptanalysis of Reduced-Round Serpent".**^**Eli Biham, Orr Dunkelman & Nathan Keller (2001). "Linear Cryptanalysis of Reduced Round Serpent". FSE 2001.**^**Bhupendra Singh; Lexy Alexander; Sanjay Burman (2009). "On Algebraic Relations of Serpent S-Boxes" (PDF).

- Anderson, Ross; Biham, Eli; Knudsen, Lars (1998). "Cryptography – 256 bit ciphers: Reference (AES submission) implementation".
- Biham, Eli. "Serpent – A New Block Cipher Proposal for AES".
- Halbfinger, David M (2008-05-05). "In Pellicano Case, Lessons in Wiretapping Skills".
*The New York Times*. - Stajano, Frank (2006-02-10). "Serpent reference implementation". University of Cambridge Computer Laboratory.

- Official website
- 256 bit ciphers – SERPENT Reference implementation and derived code