As Bram Cohen <bram@gawth.com> put it:
.> The selection of Rijndael was actually quite predictable - the round 2 ..> report made it pretty clear that the only real contenders were Rijndael c.> and Twofish, and hey, that last coin toss is free with 20/20
hindsight :)
Actually I had the clear impression that there were three real contenders: Rijndael, Serpent, and Twofish, in this order.
Not to take anything from Rijndael, which is both popular and widely respected among many critical professionals, but I suspect that one of the more long-lasting (pseudo-conspiratorial) theories about the selection of Rijndael as the AES will be built around the fact that Rijndael's design apparently allowed it -- and it alone of the final five -- to escape the scope of a current US patent issued to Hitachi (which is said to cover the use of data rotation in encryption.) (Thus -- as the tale may be told -- did the "inadequacies" of the US Patent and Trademark Office define US and world crypto standards for the 21st Century;-) I can't (for the life of me;-) figure out which of Hatachi's US crypto patents this claim is based upon, but the formal Hitachi warning to NIST -- dated last April -- that Hitachi had IP (US patents) which covered AES candidates is at: <http://csrc.nist.gov/encryption/aes/round2/comments/20000407-sharano.pdf>. I noticed, Paulo, that you were one of those who were (unsuccessfully) nagging NIST for information about their reaction to the Hitachi IP claims. Any thoughts -- or additional information to offer -- in the aftermath of the coronation? Surete, _Vin