For the last while I have been reading up on cryptography and the different kinds of methods for encryption (public key, blocks, etc) and the attacks against them. This got me wondering how to implement or calculate how well an attack would work against a encryption of my own creation.

What are the kinds of attack channels that most encryption have to protect against and how do they do it? I've read into some such as timing and information leakage, but is there a complete list out there somewhere along with information depicting on how to test a cipher against these attacks?

How are attack vectors described once one is found? I saw that some older encryption schemes depict how secure they are based on their key length (such as RSA and the private/public key bitness), and others on how many rounds minimum before a cipher is not secure (like for AES). What do these values, specifically the rounds for block ciphers like AES, mean?

Basically if I create a block cipher, what kinds of attacks should/can I test, and how would I test these attacks, against my cipher?


P.S: If people could comment free encryption related books on this subject of testing of attack vectors I would appreciate it.


closed as too broad by otus, e-sushi Mar 4 '16 at 11:06

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • $\begingroup$ those books are obviously not free, but are highly recommended, and not at a beginner level, some sections assume college level knowledge $\endgroup$ – Richie Frame Mar 4 '16 at 1:58
  • $\begingroup$ "Do not roll your own crypto". There are many layers that need to be stacked to achieve a working crypto implementation, and a slight fault in any of them can break the whole system. Primitives, security definitions, operation modes, security parameters, programming language features, solution architecture, information leakage, security policies, access control, randomness generation, side channel attacks and so on. $\endgroup$ – Sergio Andrés Figueroa Santos Mar 4 '16 at 9:56
  • $\begingroup$ The list of all the details to pay attention is just too large and complex, and so it is hard to tackle the whole chain, and more often than not, crypto fails due to non-crypto factors. $\endgroup$ – Sergio Andrés Figueroa Santos Mar 4 '16 at 9:57
  • $\begingroup$ If your interest is academic, study the basic principles of cryptography (entropy, diffusion and confusion, block and stream ciphers, public key encryption -just to name some topics) and try to focus on one point of the chain. The concerns of someone trying to build a secure block cipher are different from the ones of a person writing a crypto library, which are in turn different from the ones of someone who needs to use crypto as part of a different solution. $\endgroup$ – Sergio Andrés Figueroa Santos Mar 4 '16 at 9:57

Cryptograph Network Security by William Stallings is pretty decent read I had to read in my crypto class. Each encryption method is different, the way you can test its effectiveness as a encryption method is by what they call avalanche effects , where by changing one bit in decryption it changes a lot of other bits throughout the process.

Also I recommend checking out capture the flags online that have cryptography categories to use for real world practice. Just a simple google search will find you free sites online to practice, and you can even see write ups for the challenges to get better ideas how to attack the encrypted flag.

Hope this helps, cryptography just takes some time then you will understand it really easy. Good luck


Not the answer you're looking for? Browse other questions tagged or ask your own question.