Which algorithm is more crypto-resistant: AES or Kuznechik (GOST R 34.12-2015)?

New contributor
iEPCBM is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 3
    $\begingroup$ Please avoid Kuznechik and any algorithm with a design rationale that was never made public... Stick to AES or ChaCha20. $\endgroup$ Aug 3 at 20:49

1 Answer 1


Which algorithm is more crypto-resistant: AES or Kuznechik

No one knows (or, at least, is willing to say publicly); for both, the best published attacks take a completely and unutterably huge amount of computation to perform, far larger than what any earthly entity could plausibly have (and that remains true even if we give our adversaries cryptographically relevant quantum computers).

As for known reduced round attacks, Kuznechik looks have a better security margin; the best known attack against AES-256 breaks 9 (out of 14) rounds (64% of the way through the cipher), while the best known attack against Kuznechik breaks 5 (out of 10) rounds (50% of the way through the cipher). On the other hand, AES has been under considerably more scrutiny than Kuznechik; that might be some of the reason that the best attacks against AES get through more of the cipher.

In addition, there are known related key attacks against AES, and none against Kuznechik. On the other hand, these related key attacks are irrelevant to how AES is generally used.

On the other side, we get to the sboxes (which are included in both ciphers). For AES, the sbox is constructed using a well known (and concisely expressible) method (and was described in the initial Rijndael submission); no one believes that any backdoors were inserted there. In contrast, the Kuznechik sbox has some considerable structure; why that structure was selected is unknown (and it was not disclosed as a part of the initial Kuznechik publication, but instead discovered by cryptographers later). Now, this sbox structure may be an artifact of how the designers selected the sbox (perhaps due to some hardware optimization done for the initial implementation). Or, it might be there to enable some backdoor inserted into the Kuznechik design - such a backdoor has not been published, but it is troubling.

  • $\begingroup$ perhaps due to some hardware optimization done for the initial implementation – Do you have any information about this? Are there particular hardware optimizations which could have resulted in an S-box with those structures? $\endgroup$
    – forest
    2 days ago
  • $\begingroup$ @forest: I have absolutely no information on it - this was just speculation about a plausible (and innocent) reason why the sbox might have unexpected structure. Of course, if this were the reason, the designers could eliminate quite a bit of the controversy by stating this (and, of course, pointing out how the hardware optimization works) $\endgroup$
    – poncho
    2 days ago

Not the answer you're looking for? Browse other questions tagged or ask your own question.