13
$\begingroup$

Reading Schneier's "The Doghouse: Crypteto" dated September 30, 2009, I noticed Bruce Schneier stating:

Threefish, the block cipher inside Skein, encrypts data at 7.6 clock cycles/byte with a 256-bit key, 6.1 clock cycles/byte with a 512-bit key, and 6.5 clock cycles/byte with a 1024-bit key.

and

I'm not claiming that Threefish is secure and ready for commercial use -- at any keylength -- but there simply isn't a chance that encryption speed will drop by half for every key bit added.

If I understand things correctly, "Skein" (with Threefish at it's core) was an SHA3 candidate. So I expect that Threefish has seen some cryptanalysis since 2009.

Can you tell me if Threefish has successfully been attacked yet (either practically or theoretically) and point me to the related paper(s) so I can learn about those attacks and related security implications?

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ Only reduced round versions. See SHA-3 Zoo - Skein for an overview. $\endgroup$
    – CodesInChaos
    Nov 13, 2013 at 18:16
  • $\begingroup$ If you're looking for a tweakable blockcipher also take a look at BLAKE2's underlying blockcipher. $\endgroup$
    – orlp
    Nov 13, 2013 at 18:25

2 Answers 2

Reset to default
18
$\begingroup$

Full disclosure — I'm a Skein/Threefish co-author. Also, when I mention Skein/Threefish without any other qualification, I mean Skein/Threefish-512.

The security proofs we did for Skein prove that if there's a weakness in Skein, it implies an underlying weakness in its components (Threefish or UBI). As Dmitry says above, Threefish is very strong, and there are very few attacks on it. I don't know of one that's better than the 35-round attack we mention in V1.3 of the paper.

Our goal in Skein was that we know a lot more about designing block ciphers than hash functions so we'd build a strong hash function by starting with a strong cipher. Threefish builds on Twofish, (P)Helix, and other things. The philosophy was lots of fast rounds, and that has held up.

Enough time has passed that I'm starting to use Threefish in some of my own work. I think it's a very good way to go because tweakability is a powerful feature. If you are interested, also look at McOE mode which can turn a cipher into an authenticated function, and is designed to be resistant to misuse. It is built with AES and Threefish as examples, and I think Threefish in McOE mode is powerful.

Improve this answer
$\endgroup$
3
  • 5
    $\begingroup$ I am honored by the fact that a co-author took the time to answer my question. Thank you so very much! $\endgroup$
    – Trina
    Nov 20, 2013 at 11:00
  • $\begingroup$ Would you say that the number of rounds used for Threefish (80 if my memory serves me right) is over the top for a symmetric cipher? It seems that a hash function is is rather demanding with regards to block cipher use and 80 is a lot - even if the rounds themselves are relatively simple. $\endgroup$
    – Maarten Bodewes ♦
    Feb 29, 2016 at 9:49
  • 1
    $\begingroup$ @MaartenBodewes How many rounds is necessary and how many is too much depends entirely on how the round function works. TEA uses 64 rounds and is still vulnerable to various attacks, whereas AES has only 10 and is far more secure. Likewise with hashes, SHA-1 uses 80 rounds yet has a lower security margin than Whirlpool, which uses only 10. The fact is, the number of rounds alone tells you nothing about the algorithm's security. $\endgroup$
    – forest
    Mar 2, 2018 at 11:21
11
$\begingroup$

Pure Threefish has received less attention than Skein. Shortly speaking, it has a large security margin, and can be safely used for encryption.

In more details, Threefish has been tweaked twice. The first two versions were vulnerable to rotational cryptanalysis in weak models (related-key attacks or distinguishers) up to 57 rounds. All these attacks are impractical.

The last version of Threefish is quite strong. Even in weak models the best attacks hardly penetrate half of the cipher.

Quite surprisingly, there is no key-recovery attack even on a reduced-round version of Threefish. SHA-3 Zoo is misleading here: the key recovery attacks from its list work in the related-key model. Nevertheless, I would expect that the meet-in-the-middle attack enhanced with bicliques could penetrate up to 20-25 rounds.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.