Шифр Serpent: Анализ безопасности и особенности реализации.

All publicly known attacks are computationally infeasible, and none of them affect the full 32 round Serpent. A 2011 attack breaks 11 round Serpent (all key sizes) with 2116 known plaintexts, 2107.5 time and 2104 memory (as described in Serpent was designed by Ross Anderson, Eli Biham, and Lars Knudsen. Like other AES submissions, Serpent has a block size of 128 bits and supports a key size of 128, 192, or 256 bits. The cipher is a 32 round substitution–permutation network operating on a block of four 32 bit words. Each round applies one of eight 4 bit to 4 bit S boxes 32 times in parallel. Serpent was designed so that all operations can be executed in parallel, using 32 bit slices. This maximizes parallelism but also allows use of the extensive cryptanalysis work performed on DES. Serpent took a conservative approach to security, opting for a large security margin: the designers deemed 16 rounds to be sufficient against known types of attack but specified 32 rounds as insurance against future discoveries in cryptanalysis. The official NIST report on AES competition classified Serpent as having a high security margin like MARS and Twofish and in contrast to the adequate security margin of RC6 and Rijndael (currently AES). The reference code is public domain software, and the optimized code is licensed under the GPL. There are no restrictions or encumbrances regarding its use. As a result, anyone is free to incorporate Serpent in their software (or in hardware implementations) without paying license fees.

The Serpent key schedule consists of 3 main stages. In the first stage the key is initialized by adding padding if necessary. This is done in order to make short keys map to long keys of 256 bits, one "1" bit is appended to the end of the short key followed by "0" bits until the short key is mapped to a long key length. Hence, Rijndael was selected as the winner in the AES competition.

The original Serpent, Serpent 0, was presented at the 5th workshop on Fast Software Encryption, but a somewhat tweaked version, Serpent 1, was submitted to the AES competition. The AES submission paper discusses the changes, which include key scheduling differences.

The XSL attack, if effective, would weaken Serpent (though not as much as it would weaken Rijndael, which became AES). However, many cryptanalysts believe that once implementation considerations are taken into account the XSL attack would be more expensive than a brute force attack. In 2000, a paper by Kohno et al. presents a meet in the middle attack against 6 of 32 rounds of Serpent and an amplified boomerang attack against 9 of 32 rounds in Serpent. A 2001 attack by Eli Biham, Orr Dunkelman and Nathan Keller presents a linear cryptanalysis attack that breaks 10 of 32 rounds of Serpent 128 with 2118 known plaintexts and 289 time, and 11 rounds of Serpent 192/256 with 2118 known plaintexts and 2187 time. A 2009 paper has noticed that the nonlinear order of Serpent S boxes were not 3 as was claimed by the designers. Specifically, four elements had order 2. A 2011 attack by Hongjun Wu, Huaxiong Wang and Phuong Ha Nguyen, also using linear cryptanalysis, breaks 11 rounds of Serpent 128 with 2116 known plaintexts, 2107.5 time and 2104 memory. The same paper also describes two attacks which break 12 rounds of Serpent 256. The first requires 2118 known plaintexts, 2228.8 time and 2228 memory. The other attack requires 2116 known plaintexts and 2121 memory but also requires 2237.5 time.