Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've heard again and again that many crypto systems have been broken in the past for one reason or another and that it is best to use one that has been peer reviewed, etc etc. However, I've yet to see a source (website, book) that gives information about these systems. Is there such a thing?

share|improve this question
Concerning primitives, the SHA-3 candidates that didn't make round 2 are a nice list: – CodesInChaos Feb 4 '13 at 20:39
@CodesInChaos: +1. Great link. There are some 10 SHA-3 candidates which were completely broken. – David Schwartz Feb 5 '13 at 11:30
NSA had designed an algorithm on which an attack was found only hours after its declassification. See – Mok-Kong Shen Feb 5 '13 at 12:47
Applied Cryptanalysis – mikeazo Feb 6 '13 at 13:43

If you want to look back in time, ENIGMA was the standard used by the nazis in the 30-40's. It would be useless to encrypt anything with it now.

More recently, pratical attacks have been done against parts of the GSM standard (what cell-phones use). The cipher A5/2 which is considered completely broken and has for this reason been remove from the standard. Actually, A5/3, supposed to be better, is not looking great either right now as an attack requiring a regular computer has been done recently (2010, see wikipedia link).

These are example of practical attacks against "real life" algorithms.

You also have algorithms which never made it outside academia because of their weakness. For instance, MacGuffin was broken at the same conference it was presented!

At last, "broken" is a rather vague concept. An algorithm is usually considered "broken" if attacks much more efficient than brute-force can be done... But that does not mean they are pratical! For instance, PUFFIN (a lightweight cipher) is considered broken due to vulneranility against differential cryptanalysis. However, the amount of data required to perform the attack remains unpractically high.

For this reason, you may consider DES to not be broken because no attack is more efficient than brute-force in its case (as far as I know). However, the problem is that a brute-force attack is possible nowadays because the key size (56 bits) is too small.

share|improve this answer
A5/3 is fine, for its intended purpose. The claims that it is broken are greatly exaggerated. – D.W. Feb 6 '13 at 19:21
That attack of A5/3 is a related key attack. So unless you're using a really weird protocol, it's not relevant in practice. Just like related key attacks against AES are pretty irrelevant. – CodesInChaos Feb 7 '13 at 18:58

This is specific to TLS, but this paper lists the (surprisingly large) number of security flaws that have been found in TLS and TLS implementations.

share|improve this answer
I'm starting to get a sense that the best approach is just to look for papers from IACR. – Gustavo Litovsky Feb 4 '13 at 20:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.