VEST-16
VEST-16 root cipher (eSTREAM Phase 2): 16 nonlinear RNS counters drive a 331-bit nonlinear accumulator through a linear diffusor; 16 output bits per round, 160-bit security rating. Keys of 1 to 64 bytes, optional IV of up to 64 bytes. BROKEN - chosen-IV collision attacks exist.
Properties
| Property |
Value |
| Category |
Stream Ciphers |
| Sub-category |
NLFSR Stream Cipher |
| Security status |
❌ Broken |
| Complexity |
Expert |
| Inventor |
Sean O’Neil, Benjamin Gittins, Howard Landman |
| Year |
2006 |
| Origin |
🌐 International |
| Source |
algorithms/stream/vest.js |
Parameters
| Parameter |
Supported values |
| Key sizes |
1 byte (8 bits) to 64 bytes (512 bits) |
| Nonce sizes |
0 bytes (0 bits) to 64 bytes (512 bits) |
Security
Status: ❌ Broken
Known vulnerabilities
| Issue |
Description |
Mitigation |
| Chosen-IV Inner Collisions |
Joux and Reinhard, “Overtaking VEST” (FSE 2007): counter collisions during IV setup combined with a collision in the linear counter diffusor recover 53 bits of the keyed state with about 2^22 to 2^29 IV setups, cutting exhaustive key search by 53 bits; the same collisions forge VEST MACs |
DO NOT USE - the designers’ later fix is not part of this specification |
Documentation
References
Test vectors
5 vectors ship with this algorithm and run in the test suite. Byte values are hexadecimal.
Vector 1 — VEST-16 root cipher, 128-bit key 01000000000000000000000000000000, no IV: first 128 keystream bits
| Field |
Value |
key |
01000000000000000000000000000000 |
input |
00000000000000000000000000000000 |
expected |
87eede84f7c08d86da9841f2031cb418 |
Vector 2 — VEST-16 root cipher, 128-bit key 00000000000000000000000000000080, no IV: first 128 keystream bits
| Field |
Value |
key |
00000000000000000000000000000080 |
input |
00000000000000000000000000000000 |
expected |
4f46a7e9f6b96f88bb8beed0f6ace991 |
Vector 3 — VEST-16 root cipher, 128-bit key ffffffffffffffffffffffffffffffff, no IV: first 128 keystream bits
| Field |
Value |
key |
ffffffffffffffffffffffffffffffff |
input |
00000000000000000000000000000000 |
expected |
3612e9960bc6215688955c6c38e5f1e9 |
Vector 4 — VEST-16 root cipher, all-zero 128-bit key, IV 01000000000000000000000000000000: first 128 keystream bits
| Field |
Value |
key |
00000000000000000000000000000000 |
iv |
01000000000000000000000000000000 |
input |
00000000000000000000000000000000 |
expected |
2c68e45dc51edf42045e044a6cf37c03 |
Vector 5 — VEST-16 root cipher, all-zero 128-bit key, IV aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa: first 128 keystream bits
| Field |
Value |
key |
00000000000000000000000000000000 |
iv |
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa |
input |
00000000000000000000000000000000 |
expected |
515e6c2b6330039d25ec6e76b51a0925 |
← All algorithms