Comment by bsder

> BUT. On security margins, you could argue the Serpent designers were too conservative: https://eprint.iacr.org/2019/1492

Thanks for digging that paper out again. It is really telling that AES only gets a bit of a bump (10-30%) while the other ones gain like 2x or more.

I was about to comment that the competitors to AES were definitely too conservative, and it bit them because of how much slower it made them in software and larger in hardware.