2
$\begingroup$

I need to make it clear I know nothing about crypto so in that context I'm hoping to clear up some confusion:

As I understand it a "round" in a cipher is one encryption operation and a cipher like AES has multiple rounds. Did I get this right?

I've seen descriptions of attacks against a cipher say something like it "broke 4 out 8 rounds". In this case, if the plaintext wasn't recovered than how is it determined that any number of rounds were broken?

Thanks

Improve this question
$\endgroup$
2
  • $\begingroup$ SHA-1 is broken in the academic sense as we know that the security provided is lower than the 80 bits expected from the algorithm. As yet, not a single collision has been calculated (but we're getting close). So there is a pretty big gap between broken and exploitable. MD5 does have collisions which you can create in milliseconds, but could still be used in e.g. HMAC without too much fuss (but don't). $\endgroup$
    – Maarten Bodewes ♦
    Dec 1, 2014 at 12:27
  • $\begingroup$ It's been a few years since that comment, and now SHA-1 has demonstrated collisions. Crypto is fun! $\endgroup$
    – forest ♦
    Mar 10, 2018 at 10:29

1 Answer 1

Reset to default
8
$\begingroup$

Most encryption algorithm use a specific number of the same (or similar) group of operations. As example, AES consists of 4 different operations: SubBytes, ShiftRows, MixColumns and AddRoundKey. AES-128 (AES with a key of 128 bits) uses all this operations 10 times in 10 rounds. Well, not exactly. The last round doesn't have the MixColumns step. It would add nothing to the security which is why it's omitted.

If an attack has "broken 4 out of 8 rounds" it means that the same algorithm was broken if it would use only 4 instead of the normal 8 rounds. Using only 4 rounds instead of 10 in AES-128 is broken, even without special prequesits. Breaking a few rounds of a cipher is normal, because the secure properties of an algorithm have to slowly establish through the rounds. If 9 out of 10 rounds would be broken, that would be much more alarming. We can assume that the last round will be broken soon enough.

Now we have to mention one important thing: If an algorithm is broken it doesn't mean that someone can decrypt every message encrypted with this algorithm without the key. Nearly every attack on modern algorithms is not about this. There are different kinds of attacks: As example, a known-plaintext attack needs a special amount of plaintexts and corresponding ciphertexts to gain the key. Numbers of $2^{40} = 1\,099\,511\,627\,776$ are low, despite being something like 128 terabyte of encrypted data. A break with this small amount would be considered devastating for AES. For one special attack on AES-256 we still need ca. $2^{100}$ operations - too much in practice, despite being "broken" in the academic sense.

Improve this answer
$\endgroup$
2
  • $\begingroup$ In other words, if the attack is of an order too large to be practical, it is only shown to be correct mathematically. If you can make it mathematically likely or provable that you require less operations than brute force to retrieve key / plaintext information then you don't actually need to perform the attack to show a block cipher is broken. $\endgroup$
    – Maarten Bodewes ♦
    Dec 1, 2014 at 12:22
  • $\begingroup$ @user18550: If this has answered your question, please mark it as right answer. Thank you. :) $\endgroup$
    – Nova
    Dec 2, 2014 at 23:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.