OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Rijndael - the real work now begins
From: Ian Grigg (iangsystemics.com)
Date: Sat Oct 07 2000 - 10:00:40 CDT

Bill Stewart wrote:

> While I'm not aware of many companies doing anything about it,
> it's not really that tough - all of the algorithms had
> relatively similar parameters and sizes and calling requirements,
> and they were required to provide reference editions.
> So you should be able to write a couple of routines like
> aes_keyschedule(parm1, parm2...)
> aes_encrypt(*key, data)
> aes_decrypt(*key, data)
> and plug in the reference editions with some format-munger glue.

Yes, that could have been done. And actually, we on the team
had a good feeling about Rijndael during the last couple of
months, so we could have done that.

But somehow the thought never entered our heads, and even now,
I don't think it is valuable. What would be the benefit of
pre-announcing something like that?

Very little I suspect, because even if you get it right, you'll
still be ignored. Predicting the AES winner in advance, whilst
good fun on the lists and all, is little more than a publicity
stunt, methinks, and also a risky one. If you have been shown
to have a lucky guess, what does that say other than you are
lucky?

OTOH, moving fast to support the announced winner says something
more than just publicity. Baltimore announced on the day that
they would be deploying "over the coming months." IAIK have been
working with it for some time, and rumour has it that they are
shipping, but I can see no announcement on their site. RSA also
announced on the day saying "before the end of the year" for
Java :( I couldn't see anything on Javasoft's site, but that's
par for the course.

> Tuning the algorithms for your hardware and software environment
> is more work, and maybe you want to wait till there's a winner,
> but you get to claim you were way ahead of the curve by
> announcing support the day of the announcement...

Yep. Beyond the the fun and claims on the day, the real work is
now for the users of the software to start migrating their systems.
We've done just about all we can by putting the algorithm into the
releases and making a bit of noise. Now it's over to you guys ...

iang

http://dev.baltimore.com/aes/
http://www.rsasecurity.com/news/pr/001002-1.html