SERPENT Cipher: Learn how Serpent Works!

SERPENT Block Cipher Documentation​

---

See Simple Serpent Source Code!​

Abstract​

SERPENT is a symmetric key block cipher that was a finalist in the Advanced Encryption Standard (AES) competition. Designed by Ross Anderson, Eli Biham, and Lars Knudsen, SERPENT emphasizes a conservative design approach and a high margin of security. It operates on 128-bit data blocks and supports key sizes of 128, 192, or 256 bits. Unlike AES (Rijndael), SERPENT uses a Feistel-like substitution-permutation network (SPN) with 32 rounds, prioritizing maximum resistance to cryptanalysis over speed. Although not selected as the official AES, SERPENT remains a respected cipher for applications requiring robust, well-analyzed encryption.

---

Detailed Sections​

1. History and Motivation​

• Origin: Developed in 1998 by Anderson, Biham, and Knudsen for the AES competition.
• Philosophy: Prioritizes security margin by using more rounds (32) than theoretical necessity.
• Status: One of the five AES finalists; not selected for AES standard but published and peer-reviewed.

---

2. Algorithm Overview​

a. Block and Key Sizes​

• Block Size: 128 bits (16 bytes)
• Key Sizes: 128, 192, or 256 bits (16, 24, or 32 bytes)
• Number of Rounds: 32

b. High-Level Structure​

SERPENT is a substitution-permutation network (SPN) cipher that processes data in 32 rounds. Each round consists of the following main steps:

1. Key Mixing: XOR the state with a round key.
2. Substitution (S-Box Layer): Nonlinear transformation using one of eight 4x4 S-boxes.
3. Linear Transformation (except the last round): Achieves diffusion using bitwise operations.

c. Final Output​

After the last round, a final key mixing step is performed before outputting the ciphertext.

---

3. SERPENT Components​

a. S-Boxes (Substitution Layer)​

• SERPENT uses eight different 4x4 S-boxes, applied in a round-dependent sequence.
• Each S-box provides confusion by mapping 4 input bits to 4 output bits nonlinearly.

b. Linear Transformation​

• After S-box substitution (except in the last round), a linear transformation is applied to the 128-bit state.
• This step spreads (diffuses) the influence of each input bit across the block using bitwise rotations and XORs.

c. Key Schedule​

• The original key (128, 192, or 256 bits) is padded if needed and expanded into 33 128-bit subkeys.
• The expansion uses a recursive process based on the golden ratio and the S-boxes to ensure key diversity.

d. Initial and Final Permutations​

• The cipher includes an initial permutation (IP) and a final permutation (FP) that rearrange bits of the block for additional diffusion.

---

4. Cipher Operation​

a. Encryption Steps​

1. Apply the initial permutation to the plaintext block.
2. For each of 32 rounds:
   • XOR the state with the round key.
   • Apply the S-box layer.
   • Apply the linear transformation (skip in the final round).
3. After the last round, XOR with the final round key.
4. Apply the final permutation to produce the ciphertext.

b. Decryption Steps​

• Decryption applies the inverse operations in reverse order using the same round keys (in reverse order) and the inverse S-box and linear transformations.

---

5. Modes of Operation​

Like other block ciphers, SERPENT should be used within a secure mode of operation for practical use:

• ECB (Electronic Codebook): Not secure for multiple blocks due to patterns.
• CBC (Cipher Block Chaining): Each block is XORed with the previous ciphertext block before encryption.
• CFB/OFB/CTR: Stream-like modes for various use cases.

Note: Always use proper initialization vectors (IVs) or nonces in these modes to ensure security.

---

6. Security Considerations​

• Security Margin: With 32 rounds, SERPENT is considered to have a large safety margin and is unbroken as of 2025.
• Key Schedule: Designed to avoid related-key attacks.
• Side-Channel Attacks: As with all ciphers, implementers must guard against timing and cache attacks.
• Block Size: 128-bit blocks are standard and safe for modern applications.

---

7. Implementation Notes​

• Efficiency: SERPENT is more conservative and slightly slower than AES, but still efficient on modern CPUs and in hardware.
• Bit-Slice Design: The algorithm is particularly well-suited for bitslice implementations, enabling parallel computation and high performance on processors with wide registers (SIMD).
• Open Implementations: Reference implementations are available in C and assembly, and the cipher is patent-free.

---

8. Pseudocode Example (Single Block Encryption)​

plaintext

function SERPENT_Encrypt_Block(plaintext, user_key):
    state = InitialPermutation(plaintext)
    round_keys = KeyExpansion(user_key)
    for round = 0 to 31:
        state = state XOR round_keys[round]
        state = SBoxLayer(state, round)
        if round < 31:
            state = LinearTransform(state)
    state = state XOR round_keys[32]
    ciphertext = FinalPermutation(state)
    return ciphertext

---

9. Use Cases​

• Data-at-rest encryption (e.g., file and disk encryption)
• VPNs and secure tunnels
• Embedded systems requiring conservative security
• Cryptographic libraries as an alternative to AES

---

10. References​

• SERPENT Home Page (Ross Anderson)
• SERPENT Specification Paper (PDF)
• Wikipedia: Serpent (cipher)
• NIST AES Finalist Documentation

---

Summary Table​

Property	Value/Description
Block size	128 bits
Key sizes	128, 192, 256 bits
Rounds	32
Structure	Substitution-Permutation Network (SPN)
Security margin	Very high
Standard status	AES finalist (not selected for standard)
Applications	File, disk, and communication encryption

---

Conclusion​

SERPENT is a highly secure, conservative block cipher well-suited for applications demanding maximum cryptanalytic resistance. Its structure, round count, and lack of known vulnerabilities make it a recommended choice for long-term data protection, especially where a high security margin is prioritized over raw speed.