Cipher security summary

This article summarizes publicly known attacks against block ciphers and stream ciphers. Note that there are perhaps attacks that are not publicly known, and not all entries may be up to date.

1 Table color key
2 Best attack
3 Common ciphers
- 3.1 Key recovery attacks
- 3.2 Distinguishing attacks
4 Less common ciphers
- 4.1 Key recovery attacks
5 See also
6 References

Table color key

No known successful attacks — attack only breaks part of the cipher

Theoretical break — attack breaks all rounds and has lower complexity than security claim

Attack demonstrated in practice

Best attack

This column lists the complexity of the attack:

If the attack doesn't break the full cipher, "rounds" refers to how many rounds were broken
"time" — time complexity, number of cipher evaluations for the attacker
"data" — required known plaintext-ciphertext pairs (if applicable)
"memory" — how many blocks worth of data needs to be stored (if applicable)
"related keys" — for related-key attacks, how many related key queries are needed

Common ciphers

Key recovery attacks

Attacks that lead to disclosure of the key.

Cipher	Security claim	Best attack	Publish date	Comment
AES128	2¹²⁸	2^126.1 time, 2⁸⁸ data, 2⁸ memory	2011-08-17	Independent biclique attack.^[1]
AES192	2¹⁹²	2^189.7 time, 2⁸⁰ data, 2⁸ memory
AES256	2²⁵⁶	2^254.4 time, 2⁴⁰ data, 2⁸ memory
Blowfish	2⁴⁴⁸	4 of 16 rounds	1997	Differential cryptanalysis.^[2] Author of Blowfish recommends to use Twofish instead.^[3]
DES	2⁵⁶	2³⁹ – 2⁴³ time, 2⁴³ known plaintexts	2001	Linear cryptanalysis.^[4] In addition, broken by brute force in 2⁵⁶ time, no later than 1998-07-17, see EFF DES cracker.^[5] Cracking hardware is available for purchase since 2006.^[6]
Triple DES	2¹⁶⁸	2¹¹³ time, 2³² data, 2⁸⁸ memory	1998-03-23	Extension of the meet-in-the-middle attack. Time complexity is 2¹¹³ steps, but along with proposed techniques, it is estimated to be equivalent to 2⁹⁰ single DES encryption steps. The paper also proposes other time-memory tradeoffs.^[7]
KASUMI	2¹²⁸	2³² time, 2²⁶ data, 2³⁰ memory, 4 related keys	2010-01-10	The cipher used in 3G cell phone networks. This attack takes less than two hours on a single PC, but isn't applicable to 3G due to known plaintext and related key requirements.^[8]
RC4	up to 2²⁰⁴⁸	2²⁰ time, 2^16.4 related keys (95% success probability)	2007	Commonly known as PTW attack, it can break WEP encryption in Wi-Fi on an ordinary computer in negligible time.^[9] This is an improvement of the original Fluhrer, Mantin and Shamir attack published in 2001.^[10]
Serpent-128	2¹²⁸	10 of 32 rounds (2⁸⁹ time, 2¹¹⁸ data)	2002-02-04	Linear cryptanalysis.^[11]
Serpent-192	2¹⁹²	11 of 32 rounds (2¹⁸⁷ time, 2¹¹⁸ data)
Serpent-256	2²⁵⁶	11 of 32 rounds (2¹⁸⁷ time, 2¹¹⁸ data)
Twofish	2¹²⁸ – 2²⁵⁶	6 of 16 rounds (2²⁵⁶ time)	1999-10-05	Impossible differential attack.^[12]

Distinguishing attacks

Attacks that allow distinguishing ciphertext from random data.

Cipher	Security claim	Best attack	Publish date	Comment
RC4	up to 2²⁰⁴⁸	?? time, 2^30.6 bytes data (90% probability)	2000	Paper.^[13]

Less common ciphers

Key recovery attacks

Attacks that lead to disclosure of the key.

Cipher	Security claim	Best attack	Publish date	Comment
CAST (not CAST-128)	2⁶⁴	2⁴⁸ time, 2¹⁷ chosen plaintexts	1997-11-11	Related-key attack.^[14]
IDEA	2¹²⁸	2^126.1 time	2012-04-15	Narrow-biclique attack.^[15]
RC2	2⁶⁴ – 2¹²⁸	Unknown time, 2³⁴ chosen plaintexts	1997-11-11	Related-key attack.^[14]
RC5	2¹²⁸	Unknown
SEED	2¹²⁸	Unknown
Skipjack	2⁸⁰	2⁸⁰		ECRYPT II recommendations note that, as of 2012, 80 bit ciphers provide only "Very short-term protection against agencies".^[16] NIST recommends not to use Skipjack after 2010.^[17]
TEA	2¹²⁸	2³² time, 2²³ chosen plaintexts	1997-11-11	Related-key attack.^[14]
XTEA	2¹²⁸	Unknown
XXTEA	2¹²⁸	2⁵⁹ chosen plaintexts	2010-05-04	Chosen-plaintext, differential cryptanalysis.^[18]

References

^ Andrey Bogdanov, Dmitry Khovratovich, Christian Rechberger (2011-08-17). "Biclique Cryptanalysis of the Full AES".
^

^ https://www.computerworld.com.au/article/46254/bruce_almighty_schneier_preaches_security_linux_faithful/
^ Junod, Pascal. "On the Complexity of Matsui's Attack." Selected Areas in Cryptography, 2001, pp199–211.
^ "DES Cracker Project". EFF. On Wednesday, July 17, 1998 the EFF DES Cracker, which was built for less than $250,000, easily won RSA Laboratory's "DES Challenge II" contest and a $10,000 cash prize.
^ "COPACOBANA – Special-Purpose Hardware for Code-Breaking".
^

^ Orr Dunkelman, Nathan Keller, Adi Shamir (2010-01-10). "A Practical-Time Attack on the A5/3 Cryptosystem Used in Third Generation GSM Telephony".
^ Erik Tews, Ralf-Philipp Weinmann, Andrei Pyshkin (2007). "Breaking 104 Bit WEP in Less Than 60 Seconds". WISA 2007.
^ Scott Fluhrer, Itsik Mantin, Adi Shamir (2001-12-20). "Weaknesses in the Key Scheduling Algorithm of RC4". Selected Areas in Cryptography 2001.
^ Eli Biham, Orr Dunkelman, Nathan Keller (2002-02-04). "Linear Cryptanalysis of Reduced Round Serpent". FSE 2002.
^

^ Scott R. Fluhrer, David A. McGrew. "Statistical Analysis of the Alleged RC4 Keystream Generator" (PDF). FSE 2000. pp. 19 – 30.
^ ^a ^b ^c John Kelsey, Bruce Schneier, David Wagner (1997-11-11). "Related-key cryptanalysis of 3-WAY, Biham-DES, CAST, DES-X NewDES, RC2, and TEA". Lecture Notes in Computer Science 1334: 233–246.

^ Dmitry Khovratovich, Gaetan Leurent, Christian Rechberger. "Narrow-Bicliques: Cryptanalysis of Full IDEA".
^ Yearly Report on Algorithms and Keysizes (2012), D.SPA.20 Rev. 1.0, ICT-2007-216676 ECRYPT II, 09/2012.
^ Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths, NIST
^ Elias Yarrkov (2010-05-04). "Cryptanalysis of XXTEA".

Block ciphers (security summary)

Common algorithms	AES (Implementations) Blowfish DES (Internal Mechanics, Triple DES) Serpent Twofish

Less common algorithms	Camellia CAST-128 IDEA RC2 RC5 SEED Skipjack TEA XTEA

Other algorithms	3-Way Akelarre Anubis ARIA BaseKing BassOmatic BATON BEAR and LION CAST-256 Chiasmus CIKS-1 CIPHERUNICORN-A CIPHERUNICORN-E CLEFIA CMEA Cobra COCONUT98 Crab Cryptomeria/C2 CRYPTON CS-Cipher DEAL DES-X DFC E2 FEAL FEA-M FROG G-DES GOST Grand Cru Hasty Pudding cipher Hierocrypt ICE IDEA NXT Intel Cascade Cipher Iraqi KASUMI KeeLoq KHAZAD Khufu and Khafre KN-Cipher Ladder-DES Libelle LOKI (97, 89/91) Lucifer M6 M8 MacGuffin Madryga MAGENTA MARS Mercy MESH MISTY1 MMB MULTI2 MultiSwap New Data Seal NewDES Nimbus NOEKEON NUSH PRESENT Q RC6 REDOC Red Pike S-1 SAFER SAVILLE SC2000 SHACAL SHARK Simon SMS4 Speck Spectr-H64 Square SXAL/MBAL Threefish Treyfer UES Xenon xmx XXTEA Zodiac

Design	Feistel network Key schedule Lai-Massey scheme Product cipher S-box P-box SPN Avalanche effect Block size Key size Key whitening (Whitening transformation)

Attack (cryptanalysis)	Brute-force (EFF DES cracker) MITM (Biclique attack, 3-Subset MITM attack) Linear (Piling-up lemma) Differential (Impossible Truncated Higher-order) Differential-linear Integral (aka Square) Boomerang Mod n Related-key Slide Rotational Timing XSL Interpolation Partitioning Davies' Rebound Weak key

Standardization	AES process CRYPTREC NESSIE

Utilization	Initialization vector Mode of operation Padding

Cryptography

History of cryptography Cryptanalysis Cryptography portal Outline of cryptography

Symmetric-key algorithm Block cipher Stream cipher Public-key cryptography Cryptographic hash function Message authentication code Random numbers Steganography

Cipher security summary