3
$\begingroup$

I got asked this question and I didn't know what to answer.

How do you test the security of your cipher?

What comes to my mind now would be to test it with famous attacks: padding attacks, exhaustive searches by modifying the input and expecting the output, timing attack…

Any idea?

Improve this question
$\endgroup$
5
  • 4
    $\begingroup$ Depends a lot on what you mean by cipher. You mix concerns touching primitives, modes of operation and implementation. Each of these is tested completely differently. Primitives need lots of analysis by as many experts as possible. Modes of operation ideally feature a security proof. Implementations mainly need to avoid side channels and need to match official test vectors. $\endgroup$
    – CodesInChaos
    Apr 30, 2014 at 17:06
  • 2
    $\begingroup$ You have professional cryptographers be unsuccessful at breaking it over the course of several years. $\endgroup$
    – Stephen Touset
    Apr 30, 2014 at 17:39
  • $\begingroup$ timing attack resistance is generally done by design, not testing after the fact $\endgroup$
    – Richie Frame
    Apr 30, 2014 at 18:18
  • 2
    $\begingroup$ Enter it into a competition... whenever one comes around. Currently there doesn't seem to be a shortage of (symmetric) ciphers though. Maybe we need a few more tweakable 256 bit block ciphers though - possibly one with an integrated authentication scheme. $\endgroup$
    – Maarten Bodewes ♦
    Feb 28, 2016 at 20:08
  • $\begingroup$ If the question aims at usual software testing, I would answer: "If you ask for tests, you need to learn a lot more about security and cryptography." Alternatively, a bit more diplomatic: "That's not how cryptography works." Or even more on point: "You don't. Tests are useless". $\endgroup$
    – tylo
    Mar 30, 2019 at 12:23

1 Answer 1

Reset to default
3
$\begingroup$

This somewhat reminds me of “How do I test my encryption?” but that question was more specific than this one, which seems to be too broad in it’s current state.

Nevertheless, there’s an easy answer to your question:

  1. Check and verify all the security aspects you target with your cipher.
  2. When done, simply respect Kerckhoffs' principle and make your cipher public… that way, others can check on the security of your cipher and either confirm it’s security (which builds public trust) or they can show you what’s wrong with it.

If you need any help or have any questions while checking and verifying your cipher algorithm, please feel invited to ask more specific questions that can be answered more on-point.

Improve this answer
$\endgroup$
5
  • $\begingroup$ what about: I implemented a cipher based on some solid theory. I want to test the security of my implementation though. How do I do that? $\endgroup$
    – David 天宇 Wong
    Apr 30, 2014 at 18:34
  • 5
    $\begingroup$ @David天宇Wong Schneier's Law "Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break." That is why point 2 is so important. $\endgroup$
    – mikeazo
    Apr 30, 2014 at 19:36
  • 1
    $\begingroup$ An implementation of a cipher is a different beast entirely. Even assuming a cipher with mathematically proven properties, any implementation itself is virtually guaranteed to be imperfect. Not just that it may have weaknesses (e.g., timing attacks) or bugs (e.g., overflows), but also problems with how it's used (e.g., does it mlock() memory to avoid swapping? Does it clear memory of secrets as soon as possible? $\endgroup$
    – Stephen Touset
    Apr 30, 2014 at 19:56
  • $\begingroup$ @StephenTouset Since neither my answer, nor the question mention the word “implementation”, but the word is used in a comment by OP, I guess you were replying to David’s comment? If, then please don’t forget to mention him with an “@” and his nickname, or he won’t get notified about your comment… while I get the impression you’re commenting on my answer instead of another comment. Such confusion can be prevented with a simple “@David天宇Wong”. ;) $\endgroup$
    – e-sushi
    Apr 30, 2014 at 20:12
  • $\begingroup$ Sorry, I figured it was obvious through context. It's true though that he won't receive a notification without addressing him directly. $\endgroup$
    – Stephen Touset
    Apr 30, 2014 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.