Public Comments on AES Candidate Algorithms - Round 1

Last Modified: January 11, 2001

button AES Home Page
button Rijndael Information
button Modes of Operation
button Discussion Forum
button Recent News
button Finalist Algorithms
button Round 2 Analysis
button Round 2 Comments
button 3rd AES Conference
button R1 Algorithms
button R1 Announcement
button R1 Comments
button 2nd AES Conference
button 1st AES Conference
button Call for Candidates
button AES Beginnings


On August 20, 1998, at the First AES Candidate Conference, NIST announced the fifteen AES candidates for Round 1 evaluation, and called for public comments on those candidates. NIST also called for comments in the Federal Register of Sept. 14, 1998. These public comments could be submitted electronically to NIST.

Other, non-official discussions, have also been taking place at NIST's AES Forum. Discussions at that site should be AES-specific.

The Round 1 comment period closed on April 15, 1999, and NIST would like to thank the many people and organizations who contributed their resources to analyzing and providing comments on the candidates.

Comments Received

NIST received more than 56 sets of comments (plus papers submitted to the AES2 conference), all of which are available here. The comments are divided into several categories:

AES2 Paper Submissions (presented in order of submission)
(*) = paper presented during the conference
(R) = paper presented during the "rump" session
TITLE AUTHOR(s) Size (KB) Link
Key Schedule Classification of the AES Candidates G. Carter, E. Dawson, L. Nielsen  191 .
Pseudorandomness and Maximum Average of Differential Probability of Block Ciphers with SPN-Structures like E2 (*) M. Sugita, K. Kobara, H. Imai 287 .
Exploratory Candidate Algorithm Performance Characteristics In Commercial Symmetric Multiprocessing (SMP) Environments for the Advanced Encryption Standard (AES) L. Leibrock 7 .
An Observation on the Key Schedule of Twofish (*) F. Mirza, S. Murphy 57 .
The DFC Cipher:  an attack on careless implementations (R) I. Harvey 28 .
Future Resiliency:  A Possible New AES Evaluation Criterion (R) D. Johnson 51 .
Weaknesses in LOKI97 (*) L. Knudsen, V. Rijmen 158 .
On the Optimality of SAFER+ Diffusion (*) J. Massey 180 .
Report on the AES Candidates (*) O. Baudron, H. Gilbert, L. Granboulan, H. Handschuh, A. Joux, P. Nguyen, F. Noilhan, D. Pointcheval, T. Pornin, G. Poupard, J. Stern, S. Vaudenay 234 .
DFC Update (*) O. Baudron, H. Gilbert, L. Granboulan, H. Handschuh, R. Harley, A. Joux, P. Nguyen, F. Noilhan, D. Pointcheval, T. Pornin, G. Poupard, J. Stern, S. Vaudenay 218 .
Key Schedule Weaknesses in SAFER+ (*) J. Kelsey, B. Schneier, D. Wagner 245 button
Performance Comparison of the AES Submissions (*) B. Schneier, J. Kelsey, D. Whiting, D. Wagner, C. Hall, N. Ferguson 257 button
New Results on the Twofish Encryption Algorithm (*) (Same as previous paper) 275 button
AES Candidates:  A Survey of Implementations H. Lipmaa 43 .
Optimized Software Implementations of E2 (R) K. Aoki, H. Ueda 130 .
Cryptanalysis of Magenta (*) E. Biham, A. Biryukov, N. Ferguson, L. Knudsen, B. Schneier, A. Shamir 71 .
A Note on Comparing the AES Candidates (*) E. Biham 134 .
Implementation Experience with AES Candidate Algorithms (* invited, but could not attend) B. Gladman 46 .
Resistance Against Implementation Attacks: A Comparative Study of the AES Proposals (*) J. Daemen, V. Rijmen 183 .
Power Analysis of the Key Scheduling of the AES Candidates (*) E. Biham, A. Shamir 111 .
cAESar results: Implementation of Four AES Candidates on Two Smart Cards (*) G. Hachez, F. Koeune, J.-J. Quisquater 208 .
A Cautionary Note Regarding Evaluation of AES Candidates on Smart-Cards (*) S. Chari, C. Jutla, J.R. Rao, P. Rohatgi 280 .
On Differential Properties of Data-Dependent Rotations and Their Use in MARS and RC6 (*) S. Contini, Y.L. Yin 195 .
An Analysis of Serpent-p and Serpent-p-ns (R) O. Dunkelman 150 .
Cryptanalysis of Frog (*) D. Wagner, N. Ferguson, B. Schneier 219 button
Instruction-level Parallelism in AES Candidates (*) C. Clapp 86 .
Performance Analysis of AES candidates on the 6805 CPU core (*) G. Keating 26 button
AES JavaTM Technology Comparisons (*) A. Folmsbee 308 .

Technical contact: Morris Dworkin
Administrative/process questions: Elaine Barker, Bill Burr