Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Reading Schneier's "The Doghouse: Crypteto" dated September 30, 2009, I noticed Bruce Schneier stating:

Threefish, the block cipher inside Skein, encrypts data at 7.6 clock cycles/byte with a 256-bit key, 6.1 clock cycles/byte with a 512-bit key, and 6.5 clock cycles/byte with a 1024-bit key.


I'm not claiming that Threefish is secure and ready for commercial use -- at any keylength -- but there simply isn't a chance that encryption speed will drop by half for every key bit added.

If I understand things correctly, "Skein" (with Threefish at it's core) was an SHA3 candidate. So I expect that Threefish has seen some cryptanalysis since 2009.

Can you tell me if Threefish has successfully been attacked yet (either practically or theoretically) and point me to the related paper(s) so I can learn about those attacks and related security implications?

share|improve this question
Only reduced round versions. See SHA-3 Zoo - Skein for an overview. – CodesInChaos Nov 13 '13 at 18:16
If you're looking for a tweakable blockcipher also take a look at BLAKE2's underlying blockcipher. – orlp Nov 13 '13 at 18:25
up vote 12 down vote accepted

Full disclosure — I'm a Skein/Threefish co-author. Also, when I mention Skein/Threefish without any other qualification, I mean Skein/Threefish-512.

The security proofs we did for Skein prove that if there's a weakness in Skein, it implies an underlying weakness in its components (Threefish or UBI). As Dmitry says above, Threefish is very strong, and there are very few attacks on it. I don't know of one that's better than the 35-round attack we mention in V1.3 of the paper.

Our goal in Skein was that we know a lot more about designing block ciphers than hash functions so we'd build a strong hash function by starting with a strong cipher. Threefish builds on Twofish, (P)Helix, and other things. The philosophy was lots of fast rounds, and that has held up.

Enough time has passed that I'm starting to use Threefish in some of my own work. I think it's a very good way to go because tweakability is a powerful feature. If you are interested, also look at McOE mode which can turn a cipher into an authenticated function, and is designed to be resistant to misuse. It is built with AES and Threefish as examples, and I think Threefish in McOE mode is powerful.

share|improve this answer
I am honored by the fact that a co-author took the time to answer my question. Thank you so very much! – Trina Nov 20 '13 at 11:00
Would you say that the number of rounds used for Threefish (80 if my memory serves me right) is over the top for a symmetric cipher? It seems that a hash function is is rather demanding with regards to block cipher use and 80 is a lot - even if the rounds themselves are relatively simple. – Maarten Bodewes Feb 29 at 9:49

Pure Threefish has received less attention than Skein. Shortly speaking, it has a large security margin, and can be safely used for encryption.

In more details, Threefish has been tweaked twice. The first two versions were vulnerable to rotational cryptanalysis in weak models (related-key attacks or distinguishers) up to 57 rounds. All these attacks are impractical.

The last version of Threefish is quite strong. Even in weak models the best attacks hardly penetrate half of the cipher.

Quite surprisingly, there is no key-recovery attack even on a reduced-round version of Threefish. SHA-3 Zoo is misleading here: the key recovery attacks from its list work in the related-key model. Nevertheless, I would expect that the meet-in-the-middle attack enhanced with bicliques could penetrate up to 20-25 rounds.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.