Subject: [ietf-tls] MISTY1 and CAMELLIA Ciphersuites

From: "Andreas Sterbenz" <[email-masked]>
Date: Mon, 27 Nov 2000 20:23:23 +0100

What is the general opinion about the proposed MISTY1 and CAMELLIA
ciphersuites?

Without having really studied the algorithms I do not quite see the
advantages over existing TLS ciphers and AES, given that:

(a) AES is available worldwide without any legal encumberings. This is not
the case for MISTY1 and CAMELLIA.
(b) MISTY1 and CAMELLIA will never receive the same cryptanalytic attention
as AES.
(c) AES will be implemented in virtually all future cryptographic software
and hardware.

Maybe the supporters can shed some light on this.

 Andreas Sterbenz              mailto:[email-masked]

---
You are currently subscribed to ietf-tls as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Shiho MORIAI <[email-masked]>
Date: Wed, 29 Nov 2000 16:59:15 JST

I'd like to make some comments as a designer of Camellia and a writer
of draft-ietf-tls-camellia-00.txt. 

Andreas Sterbenz wrote:
>(a) AES is available worldwide without any legal encumberings. This
>is not the case for MISTY1 and CAMELLIA.

(1) The intellectual property statement of Camellia regarding
royalty-free license is now under review by NTT and Mitsubishi
Electric Corporation.  I hope the problem of worldwide royalty-free
availability of Camellia will be solved by the end of this year.

>(b) MISTY1 and CAMELLIA will never receive the same cryptanalytic
>attention as AES.

(2) Camellia was designed based on the experiences of the design and
development of E2 and MISTY. E2 was published in 1998 and received
much cryptanalytic attention as a candidate of the AES during the AES
Round 1 process. MISTY was published in 1996 and has been received
much cryptanalysis, too. Recently, 3GPP adopted a variant of MISTY1,
which is called KASUMI, as the confidentiality and integrity algorithm
for the W-CDMA mobile systems after the elaborate evaluation process.

Camellia has been scrutinized during the design phase by the designers
(including Matsui, who is the inventor of linear cryptanalysis), and
also by external experts including some of the designers of the AES
finalists. Their technical papers are available at
http://info.isl.ntt.co.jp/camellia/.

Moreover, Camellia was submitted to the NESSIE project
(http://www.cryptonessiee.org/) and the CRYPTREC project
(http://www.ipa.go.jp/security/enc/CRYPTREC/index-e.html) where the
submitted cryptographic techniques will be evaluated.  Camellia was
announced in March 2000 for the first time, and presented at SAC2000
and CRYPTO2000 (rump session) this summer.  The promising algorithms
always receive cryptanalytic attention.

>(c) AES will be implemented in virtually all future cryptographic
>software and hardware.

(3) I believe that TLS need backup/alternative algorithms to AES, i.e. 
block ciphers with the same block size and key sizes. We believe that
Camellia can be a nice complement cipher to AES, because it has many
advantages over AES (strictly speaking, Rijndael, as the proposed
AES).

* Efficiency in hardware implementations
  - Smaller hardware: 9.66 Kgates (0.35micron ASIC)
  - Better Throughput/Area:  21.9Mbit/(sec*Kgates)
  - Much more efficient in implementing BOTH encryption and decryption
    (Rijndael needs more additional area in implementing both
     encryption and decryption.)

* Excellent Key Agility
  - Shorter key setup time 
     Ex) 128bit key, for Encryption
      Camellia: 160 cycles [Pentium III, Assembly]
                263 cycles [Pentium II, ANSI C]
      Rijndael: 305 cycles [Pentium Pro/II, Visual C++] by Gladman
  - Supports on-the-fly subkey computation for both encryption and
    decryption 
    (Rijndael requires a one-time execution of the key schedule prior
     to the first decryption with a specific key.)

* Symmetric Encryption and Decryption 
	(because Camellia is a Feistel cipher)
  - Little additional area to implement both encryption and decryption
    in hardware
  - Little additional resources are favorable in restricted-space
    environments

* Good JAVA Performance
  - Encryption Speed is 36Mbit/sec on Pentium II 300MHz.
    Compared with the AES finalists using Sterbenz and Lipp's data
    presented at the 3rd AES conference, Camellia is faster than
    Rijndael (and the second fastest among  the AES finalists.)
     
* Comparable performance on 8-bit CPUs e.g. Z80
  
Further detailed information about performance figures and 
comparison is available at the URL below.  
http://info.isl.ntt.co.jp/camellia/

Shiho Moriai

---

---

From: Hironobu SUZUKI <[email-masked]>
Date: Wed, 29 Nov 2000 18:02:21 +0900

> availability of Camellia will be solved by the end of this year.

It's sounds great! But if Camellia royalty-free license is like as
MISTY1, it's not enough for me and many people.  I wrote MISTY1 C code
and distributed it as GPL in 11 January 1998.

	URL: http://www.pp.iij4u.or.jp/~h2np

MISTY1 free license is permitted for academic (non-profit) use. But it
have been uncleared what academic (non-profit) is.  And There is no
obvious definition of "academic", "non-profit" and "commercial".
MISTY1 situation made me very confused.  I've thought that MISTY1 was
the best choice in 1998 but legal issues was the worst.

Could you make your optimized Camellia C/Java codes as GPL? GPL
licensed codes is very clear to use as "royality-free" code.

-- 
Hironobu SUZUKI        Independent Software Consultant
E-Mail: [email-masked]
URL: http://h2np.net

---