Ciphers · Modern symmetric ciphers
The Serpent cipher
The cautious AES finalist. It runs 32 rounds of small S-boxes and a linear mix, and no attack gets near the full cipher.
Serpent is a block cipher designed by Ross Anderson, Eli Biham and Lars Knudsen. It was a finalist in the competition that chose AES, and it came second to Rijndael. Its approach was cautious to a fault. AES has 10 rounds where Serpent has 32, so the best known attacks are still a long way from breaking it. It's the cipher for people who'd rather have a big security margin than speed. Its closest relatives on this site are Twofish, the other finalist, and DES, the standard the competition replaced.
How it works
Serpent encrypts a 128-bit block under a 128-, 192- or 256-bit key, using a substitution–permutation network of 32 rounds. Each round does three things.
- Key mixing. XOR the 128-bit state with that round's 128-bit subkey.
- S-boxes. Apply a small substitution to every group of 4 bits, which means 32 S-boxes working in parallel on the 128-bit state. There are eight different 4-bit S-boxes. Round i uses S-box number i mod 8 on all 32 groups, so each S-box turns up in four of the 32 rounds.
- Linear transformation. Rotate and XOR the state's four 32-bit words together, so every output bit depends on many input bits. The last round swaps this step for an extra key mixing.
The S-boxes were designed for bitslicing, a software technique that does the 32 parallel 4-bit lookups as a handful of logical operations on whole words, with no table lookups at all. That makes Serpent resistant to cache-timing leaks and quick on processors that do many bitwise operations at once, though it's still not as fast as hardware-assisted AES.
Serpent and its rivals
Serpent and AES are built the same way: a substitution-permutation network on a 128-bit block, with an S-box layer, a mixing layer and a key addition in each round. They differ in where they spend their effort. AES uses large (8-bit) S-boxes and a strong mixing step, so it needs only 10 to 14 rounds. Serpent uses small (4-bit) S-boxes and a lighter mixing step, and makes up for it with 32 rounds. Twofish, the other finalist described on this site, is a Feistel network with 16 rounds and key-dependent S-boxes. That makes three designs and three views of the same trade-off between how much each step does and how many steps there are.
The easiest way to see the margin is to count rounds. Serpent's designers estimated that 16 rounds would resist every attack they knew, and they published 32. The best public attacks on the cipher reach 10 to 12 rounds, about a third of the full 32. If a new attack gained a few more rounds, Serpent would still be safe. A cipher with fewer rounds and a thinner margin could be left with very little.
A very large margin
The designers thought 16 rounds were enough against every attack they knew of, and picked 32 as insurance. NIST rated its security margin as high. In practice no public attack reaches the full 32 rounds. Published attacks reach 10 to 12, such as a 2011 attack on 11-round Serpent-128. In the AES evaluation Serpent got the fewest negative votes among the finalists, but Rijndael got more positive votes and had a much more efficient software implementation. That's the trade. Doubling the round count costs roughly twice the time, and it buys safety on a cipher that was already secure.
The algorithm is in the public domain with no patents, and the optimized code is under the GPL. A number of disk encryption tools include it, sometimes cascaded with AES and Twofish so that a break in one cipher wouldn't break the whole.
Where you'll meet it
Serpent is rarely the default anywhere. More often it's an option for users who want a conservative second choice. Disk-encryption tools such as VeraCrypt offer it, alone or in a cascade with AES and Twofish, so that a flaw in one cipher wouldn't expose the data. Libraries including GnuPG's and the Linux kernel's cryptographic API include it. Its role matches its design: a belt-and-braces cipher.
Common questions
Is Serpent more secure than AES?
It has a larger margin between its round count and the best attacks, so many cryptographers regard it as the more conservative design. Both are secure in practice, and AES has hardware support and the most scrutiny going for it.
Is Serpent patented?
No. The algorithm is in the public domain and unpatented, and the designers' optimized code is released under the GPL.
Why is Serpent slower?
It has 32 rounds instead of 10 to 14, and common CPUs have no dedicated hardware for it. In software it's typically slower than AES with hardware instructions, and slower than Twofish.
Has Serpent been attacked?
Many times, and the full 32 rounds have held. Published attacks reach 10 to 12 rounds, such as a 2011 attack on 11-round Serpent-128, which leaves about two thirds of the cipher untouched.
What's bitslicing?
A way of implementing small S-boxes as a few logical operations applied to many bits at once. It avoids table lookups, which makes the code faster on some processors and free of cache-timing leaks.