# How do you test the security of your cipher?

I got asked this question and I didn't know what to answer.

How do you test the security of your cipher?

What comes to my mind now would be to test it with famous attacks: padding attacks, exhaustive searches by modifying the input and expecting the output, timing attack…

Any idea?

• Depends a lot on what you mean by cipher. You mix concerns touching primitives, modes of operation and implementation. Each of these is tested completely differently. Primitives need lots of analysis by as many experts as possible. Modes of operation ideally feature a security proof. Implementations mainly need to avoid side channels and need to match official test vectors. – CodesInChaos Apr 30 '14 at 17:06
• You have professional cryptographers be unsuccessful at breaking it over the course of several years. – Stephen Touset Apr 30 '14 at 17:39
• timing attack resistance is generally done by design, not testing after the fact – Richie Frame Apr 30 '14 at 18:18
• Enter it into a competition... whenever one comes around. Currently there doesn't seem to be a shortage of (symmetric) ciphers though. Maybe we need a few more tweakable 256 bit block ciphers though - possibly one with an integrated authentication scheme. – Maarten Bodewes Feb 28 '16 at 20:08
• If the question aims at usual software testing, I would answer: "If you ask for tests, you need to learn a lot more about security and cryptography." Alternatively, a bit more diplomatic: "That's not how cryptography works." Or even more on point: "You don't. Tests are useless". – tylo Mar 30 at 12:23

This somewhat reminds me of “How do I test my encryption?” but that question was more specific than this one, which seems to be too broad in it’s current state.

• An implementation of a cipher is a different beast entirely. Even assuming a cipher with mathematically proven properties, any implementation itself is virtually guaranteed to be imperfect. Not just that it may have weaknesses (e.g., timing attacks) or bugs (e.g., overflows), but also problems with how it's used (e.g., does it mlock() memory to avoid swapping? Does it clear memory of secrets as soon as possible? – Stephen Touset Apr 30 '14 at 19:56