Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've discovered that a client has SEED enabled in their SSL ciphers, and would like to know a bit more about it from a security perspective. The Wikipedia article doesn't mention any flaws, yet I've found two papers that demonstrate attacks - a differential fault analysis, which is fast but has infeasible requirements, and another differential attack that breaks 8 rounds.

For example, this paper says you can do key recovery by injecting faults into the input registers of the G function. What does that entail at a practical level?

Am I missing anything else? Is there anything I should warn them of?

share|improve this question
up vote 4 down vote accepted

A fault injection attack is based on the fact that you have a healthy black box on which you can do queries, but you can mess with the black box, for example flipping random bits.

In real life this could for example be a RFID chip which can be messed with using strong electronic fields. Attacks like these are generally:

  1. Very sophisticated in theory and equipment.
  2. Only apply to "black box models"; you have a side channel into the crypto device, but can't actually access the key.

Other than that, I'm not aware of any successful cryptanalysis against full-round SEED. So my suggestion is to warn your client of the hardware side-channel attacks (but since the question is about SSL I don't think it's applicable), but also make sure their software implementation is side-channel free.

share|improve this answer

There are two papers on conventional differential cryptanalysis of SEED. The last one penetrates only half of the cipher. Even though there are few third-party cryptanalysis papers, there is no indication that the cipher is weak. Fault attacks are quite irrelevant in the SSL setting. I would be more concerned with BEAST-like attacks, as SEED is a blockcipher, and SSL is well known to be weak in this aspect.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.