VEST-8
VEST-8 root cipher (eSTREAM Phase 2): 16 nonlinear RNS counters drive a 211-bit nonlinear accumulator through a linear diffusor; 8 output bits per round, 128-bit security rating. Keys of 1 to 64 bytes, optional IV of up to 64 bytes. BROKEN - chosen-IV collision attacks exist.
Properties
| Property |
Value |
| Category |
Stream Ciphers |
| Sub-category |
NLFSR Stream Cipher |
| Security status |
❌ Broken |
| Complexity |
Expert |
| Inventor |
Sean O’Neil, Benjamin Gittins, Howard Landman |
| Year |
2006 |
| Origin |
🌐 International |
| Source |
algorithms/stream/vest.js |
Parameters
| Parameter |
Supported values |
| Key sizes |
1 byte (8 bits) to 64 bytes (512 bits) |
| Nonce sizes |
0 bytes (0 bits) to 64 bytes (512 bits) |
Security
Status: ❌ Broken
Known vulnerabilities
| Issue |
Description |
Mitigation |
| Chosen-IV Inner Collisions |
Joux and Reinhard, “Overtaking VEST” (FSE 2007): counter collisions during IV setup combined with a collision in the linear counter diffusor recover 53 bits of the keyed state with about 2^22 to 2^29 IV setups, cutting exhaustive key search by 53 bits; the same collisions forge VEST MACs |
DO NOT USE - the designers’ later fix is not part of this specification |
Documentation
References
Test vectors
5 vectors ship with this algorithm and run in the test suite. Byte values are hexadecimal.
Vector 1 — VEST-8 root cipher, 128-bit key 01000000000000000000000000000000, no IV: first 128 keystream bits
| Field |
Value |
key |
01000000000000000000000000000000 |
input |
00000000000000000000000000000000 |
expected |
fc1b52fb52244e610ef2633ba45f8aac |
Vector 2 — VEST-8 root cipher, 128-bit key 00000000000000000000000000000080, no IV: first 128 keystream bits
| Field |
Value |
key |
00000000000000000000000000000080 |
input |
00000000000000000000000000000000 |
expected |
884c87fbb02f733f6057214b6499cb03 |
Vector 3 — VEST-8 root cipher, 128-bit key ffffffffffffffffffffffffffffffff, no IV: first 128 keystream bits
| Field |
Value |
key |
ffffffffffffffffffffffffffffffff |
input |
00000000000000000000000000000000 |
expected |
6f7b3d07da2246d9dfd15c56951b6e36 |
Vector 4 — VEST-8 root cipher, all-zero 128-bit key, IV 01000000000000000000000000000000: first 128 keystream bits
| Field |
Value |
key |
00000000000000000000000000000000 |
iv |
01000000000000000000000000000000 |
input |
00000000000000000000000000000000 |
expected |
443c1fece8585070ed5bd90cb6563cca |
Vector 5 — VEST-8 root cipher, all-zero 128-bit key, IV aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa: first 128 keystream bits
| Field |
Value |
key |
00000000000000000000000000000000 |
iv |
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa |
input |
00000000000000000000000000000000 |
expected |
4658f26e009f79ec5a63d85192ffff4d |
← All algorithms