6

Was any specific rationale given on why none of the sponge-based AEAD algorithms (specifically NORX, Keyak, and Ketje) of the 3rd round candidates of the CAESAR competition made it to the final portfolio? If so, where can I find additional details?

Astolfo
  • 149
  • 3

1 Answers1

4

This is an interesting question , here are some main points to identify major differences between Caesar winners and above-mentioned algorithm

Background

  • Norx is LRX- Duplex based authenticated encryption scheme designed for lightweight and high-performance use cases.
  • Ketje is Keccak-f-Duplex based authenticated encryption scheme designed for lightweight (except Ketje Major for high performance)
  • Keyak is Keccak-f-Duplex based authenticated encryption scheme designed for high-performance (except River Keyak for lightweight)
  • The winners of Lightweight use case are Ascon (SPN-duplex based authenticated encryption cipher and Acorn (stream based authenticated encryption).
  • The winners of high-performance case are AEGIS (AES-Block cipher authenticated encryption), OCB (AES-XEX authenticated encryption) and MORUS (LRX-stream cipher )

Performance

  • A hardware benchmark on Virtex6 , Virtex-7 and Straix-IV shows the Acorn and Ascon have the lowest Area/$A_{GCM}$ compared to Norx , Ketje and Keyak (0.16 and 0.4 on average).

  • The hardware performance in term of throughput/ Area and throughtput/AES-GCM throughput for AEGIS and MORUS across Virtex6 , Virtex-7 and Straix-IV are very high compared to OCB , Ketje , Norx and Keyak.

  • The software performance in this chart shows the , AEGIS, OCB and MORUS have lower cycles per bytes (higher performance ) compared to Ketje , Norx and Keyak.

Security

  • A paper presented in FSE 17 (cryptanalysis of NORX2) concluded Almost practical forgery and key recovery attack on NORX v2.0.

Further Details

PS:Iam happy to see if someone provide more selection rationals.

Hardware benchmark

hardyrama
  • 2,288
  • 1
  • 17
  • 41