A Performance Comparison of the Five AES Finalists

B. Schneier and D. Whiting

Third AES Candidate Conference, 2000, to appear.

ABSTRACT: In 1997, NIST announced a program to develop and choose an Advanced Encryption Standard (AES) to replace the aging Data Encryption Standard (DES). NIST chose five finalists in 1999. We compare the performance of the five AES finalists on a variety of common software platforms: current 32-bit CPUs (both large microprocessors and smaller, smart card and embedded microprocessors) and high-end 64-bit CPUs. Our intent is to show roughly how the algorithms' speeds compare across a variety of CPUs. Then, we give the maximum rounds cryptanalyzed for each of the algorithms, and re-examine all the performance numbers for these variants. We then compare the algorithms again, using the minimal secure variants as a way to more fairly align the security of the five algorithms.

[full text - PDF (Acrobat)] - [full text - Postscript]

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..