# How do you test the security of your cipher?

I got asked this question and I didn't know what to answer.

How do you test the security of your cipher?

What comes to my mind now would be to test it with famous attacks: padding attacks, exhaustive searches by modifying the input and expecting the output, timing attack…

Any idea?

• Depends a lot on what you mean by cipher. You mix concerns touching primitives, modes of operation and implementation. Each of these is tested completely differently. Primitives need lots of analysis by as many experts as possible. Modes of operation ideally feature a security proof. Implementations mainly need to avoid side channels and need to match official test vectors. – CodesInChaos Apr 30 '14 at 17:06
• You have professional cryptographers be unsuccessful at breaking it over the course of several years. – Stephen Touset Apr 30 '14 at 17:39
• timing attack resistance is generally done by design, not testing after the fact – Richie Frame Apr 30 '14 at 18:18
• Enter it into a competition... whenever one comes around. Currently there doesn't seem to be a shortage of (symmetric) ciphers though. Maybe we need a few more tweakable 256 bit block ciphers though - possibly one with an integrated authentication scheme. – Maarten Bodewes Feb 28 '16 at 20:08
• If the question aims at usual software testing, I would answer: "If you ask for tests, you need to learn a lot more about security and cryptography." Alternatively, a bit more diplomatic: "That's not how cryptography works." Or even more on point: "You don't. Tests are useless". – tylo Mar 30 '19 at 12:23

This somewhat reminds me of “How do I test my encryption?” but that question was more specific than this one, which seems to be too broad in it’s current state.

Nevertheless, there’s an easy answer to your question:

1. Check and verify all the security aspects you target with your cipher.
2. When done, simply respect Kerckhoffs' principle and make your cipher public… that way, others can check on the security of your cipher and either confirm it’s security (which builds public trust) or they can show you what’s wrong with it.

If you need any help or have any questions while checking and verifying your cipher algorithm, please feel invited to ask more specific questions that can be answered more on-point.

• what about: I implemented a cipher based on some solid theory. I want to test the security of my implementation though. How do I do that? – David 天宇 Wong Apr 30 '14 at 18:34
• @David天宇Wong Schneier's Law "Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break." That is why point 2 is so important. – mikeazo Apr 30 '14 at 19:36
• An implementation of a cipher is a different beast entirely. Even assuming a cipher with mathematically proven properties, any implementation itself is virtually guaranteed to be imperfect. Not just that it may have weaknesses (e.g., timing attacks) or bugs (e.g., overflows), but also problems with how it's used (e.g., does it mlock() memory to avoid swapping? Does it clear memory of secrets as soon as possible? – Stephen Touset Apr 30 '14 at 19:56
• @StephenTouset Since neither my answer, nor the question mention the word “implementation”, but the word is used in a comment by OP, I guess you were replying to David’s comment? If, then please don’t forget to mention him with an “@” and his nickname, or he won’t get notified about your comment… while I get the impression you’re commenting on my answer instead of another comment. Such confusion can be prevented with a simple “@David天宇Wong”. ;) – e-sushi Apr 30 '14 at 20:12
• Sorry, I figured it was obvious through context. It's true though that he won't receive a notification without addressing him directly. – Stephen Touset Apr 30 '14 at 20:26