I am an undergraduate (grade three). I am confused about the cryptanalysis. Because a lot people say that the modern ciphers are complete and they can't be cracked. Maybe the prospects for cryptanalysis are bleak?


2 Answers 2


Modern cryptanalysis are among the tools to verify the security (or completeness as you mentioned) of ciphers.

For example, we try to break reduced-round hash functions (e.g. breaking a 16-round SHA-256, when it actually has 64 rounds) as a way of assessing how robust the cryptographic algorithms are.

Cryptanalysis is constantly evolving as new algorithms and hardness assumptions turn up. For example, the post-quantum cryptography standardization project initiated by NIST is still running with some code-based key encapsulation mechanisms and various "on-ramp" (they're proposed after the project started) digital signature algorithms being evaluated - they require new knowledge before we can be confident in their security.

Even traditional and established symmetric-key cryptography is evolving towards higher throughput, lower computational and energy overhead.

So cryptanalysis isn't becoming bleak, it'll only get more active and advanced in the future.


I disagree with those people.

Even at the cryptographic primitive level, recent years have seen surprising and devastating key recovery attacks on what were designs under consideration for standardisation. The two obvious examples are Buellens's Breaking Rainbow takes a weekend on a laptop and Castryck and Decru's An efficient key recovery attack on SIDH.

Less spectacularly, recent years have seen impressive progress in lattice algorithms as illustrated in red in this graphic by Dan Bernstein on the log-complexity vs dimension of the short vector problem:

enter image description here Another significant advance in lattice-based cryptanalysis include last year's work by Henninger and Ryan Fast Practical Lattice Reduction through Iterated Compression.

Moving away from direct attacks on hard problems, we can look at our how our toolkits can be deployed to best effect. The MATZOV Report on the Security of LWE: Improved Dual Lattice Attack, showed that there is value in intense optimisation parameters (at least sufficient to revisit costing assumptions).

Drilling further down we can see many recent papers on fault-induced and sidechannel cryptanalysis (at this case selecting individual papers feels subjective).

The negative position is perhaps more understandable in the area of symmetric cryptanalysis, where designs such as AES, and CHACHA20 are consdiered mature and robust. Designs such as these are highly-over-engineered to resist very unrealistic attack scenarios and have undergone significant scrutiny. It would be world-shaking if a realistic, practical attack could be demonstrated against the underlying design of these. Even so, new symmetric cryptanalytic ideas such as boomerang connectivity and linear hulls help us to maintain that high level of assurance.

Even with symmetric cryptanalysis though there is the potential for insecure use of a secure primitive. Many products and protocols are designed without a careful view to cryptanalysis. Attacks on block cipher modes continue and motivate the call for more secure modes such as the NIST call for research into accordion modes.

Likewise, application/implementation level attacks on symmetric ciphers is a key part of cryptographic assurance.

I have enough ideas to pursue within cryptanalysis to keep me busy for the rest of my career, and have sketched out long-term cryptanalysis programmes for the future (if you're feeling brave there's a desperate shortage of people who understand both cryptanalysis and quantum computation). History is littered with people who felt that the last word had been written in cryptanalysis; don't be the latest to add yourself to this list.

  • $\begingroup$ Thank you for answers.I am going to be a graduate student, and I have to decide my research direction in these six months.For graduate projects, I struggle with whether to follow hot topics, such as MPC , zero-knowledge proof even or post-quantum.I notice that there are very few papers on cryptanalysis in the four/three major conferences(NDSS,IEEE S&P,CCS,USENIX security,CRYPTO,Eurocrypt,Aisacrypt) in recent years.this is also one of reasons i confused.Maybe I don't need to think about it that much. $\endgroup$ Mar 27 at 14:59
  • $\begingroup$ I disagree; Rainbow and SIHD were not complete. They were candidate and failed! Like many e-stream and hash candidates. I think the modern ciphers are vague in the question. $\endgroup$
    – kelalaka
    Mar 27 at 15:10
  • $\begingroup$ Do you have a source for the Bernstein graphic. Clark and Cain is kind of interesting as a marked start point, and I'd like to see more context $\endgroup$
    – kodlu
    Mar 27 at 17:50
  • 1
    $\begingroup$ @kodlu Slide 4 of his presentation at USENIX 2020 $\endgroup$
    – Daniel S
    Mar 27 at 18:02
  • $\begingroup$ thanks, clark-cain crediting (jim) omura makes more sense. $\endgroup$
    – kodlu
    Mar 27 at 18:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.