I have been looking at both the paper as well as the sourcecode of Spritz — a spongy RC4-like stream cipher and hash function by Ronald L. Rivest and Jacob Schuldt.

The paper states

We have also performed extensive simulations to look for detectable statistical biases, and selected a candidate with no biases detected in our experiments. Further cryptanalytic review is recommended before this cipher is used in critical applications.

Since this is the first time I am witnessing the birth of a "new" cipher algorithm, I don’t know what to think of Spritz. Mainly, because part of it uses RC4, which seems to be known for its detectable bias, related to the state shuffling. But there’s also the "spongy" functionality in there, which reminds me of what I have read about SHA-3... but can that change be interesting enough to even think about touching it?

I am not much of an analyst, but my simple C timing function tells me Spritz is slower than RC4. Probably even slower than AES too. (I have to admit my AES implementation is not the fastest around.) No one seems to have cryptanalysed Spritz yet. And the distant sound of biased RC4 doesn’t provide comfort either.

This leaves three basic options for me to choose from:

  1. Ignore it completely and wait until someone provides a good reason to use it (good reasons not to use it seem to be: RC4 related, slow,...)
  2. Have fun with it while trying out my first baby-steps trying to apply some basic attacks to learn from the experience without really hoping to actually be able to break anything
  3. Be exited and wait because there might be a dozen of smart people that are already pulling it apart from all sides to find out if it is secure or not.

So, how should I treat a new cipher release like Spritz?

Actually I’m hoping the answer is *"have fun with it". If that’s the case, can you give me a few hints about which analysis/attack/break would be the most appropriate to try on a cipher like Spritz? I have just started learning about linear and differential cryptanalysis, but I am willing and able to expand my knowledge if this is a chance to do so. I don’t need a list, just a hint or two... a gentle push, not a kick. ♥

  • $\begingroup$ I’m excited but waiting… I can see it simplify the entire MirBSD entropy subsystem (beyond just arc4random). $\endgroup$
    – mirabilos
    Commented Nov 14, 2014 at 14:22
  • 1
    $\begingroup$ 3. waiting turned out to be the right thing to do. Unfortunately, Spritz is alledgedly broken. $\endgroup$
    – mirabilos
    Commented Jan 13, 2017 at 15:14

1 Answer 1


Nobody can tell you not to "have fun with it" but I would strongly recommend you to first study attacks on other ciphers. Spritz (Rivest & Schuldt) fortunately mentions a lot of research on its predecessor, RC4. This makes it a rather good starting point in my opinion.

It is necessary to understand the linguistics and mathematical constructs that are used. Jumping into crypto-analysis without a good understanding of the concepts will not get you any reasonable results.

If your main competence is to create a fast/secure implementation of cipher algorithms, then go for it. In the worst scenario an attack is found or the algorithm never receives wide popularity.

I don't see the big difference between 1) and 3) outside your own state of mind. Again, nobody can tell you not to be exited :)

  • 2
    $\begingroup$ Added some Spritz related information; interesting cipher indeed. Drop in replacement for RC4 and it resembles a sponge. $\endgroup$
    – Maarten Bodewes
    Commented Aug 30, 2014 at 12:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.