# How to break a 32 bit block cipher without key?

From what I know Skip32 is the only 32 bit block cipher and I heard its not secure. What do I do or which tool do I use to break a 32-bit block cipher? I did search for this but all I find is attacks for DES(64 bit) and AES(128 bit) but none for Skip32.

• skip32 is based on the NSA skipjack algorithm. The key size is "only" 80 bits, which is high enough to be difficult to attack. There's another attack which targets 31 of 32 rounds, but only improves the complexity slightly. Do you know of anything more than what's on the Wikipedia page? May 18 '16 at 20:17
• No sorry.... I'm not really a pro at cryptography. But I did a lot of search about possible attack. Didn't find any for skip32 though. They were all about AES and DES
– CodeMaxx
May 18 '16 at 21:35
• There are lots of papers with attacks on lots of ciphers (not just AES and DES!). Look up FEAL e.g. Mar 3 '19 at 23:38

The block size does not directly determine the security of a block cipher. Even with a 32 bit block cipher the number of possible permutations is 2^32!, a stupendously big number.

Small block sizes are however cumbersome to use in secure modes of operation as the input is limited. For instance, it would be easy to have repeating counters in counter mode encryption.

So attacks generally rely on low key sizes or - of course - the construction of the algorithm itself. Now for Skipjack there don't seem to be any known attacks. The key size is not very large, but brute forcing it seems still (just) out of reach.

Skip32 seems to use the same key size. It seems to use largely the same structures and 24 out of the original 32 rounds. Skipjack has only been attacked successfully for 16 rounds. So it is very possible that it is secure. The problem is that this cipher doesn't seem to have any paper or design document assigned to it. Basically there is just code and comments. This is a likely reason that no crypto-analysis can be found.

So basically: there is no generic attack against 32 bit block ciphers. Skip32 could well be secure, but as it hasn't been analyzed, nobody knows for sure. AES and DES on the other hand are well used and analyzed (and survived pretty well under those circumstances).

If you want to attack it, it might be best to check if the the way it is used is secure or not, because the 32 bit block size will certainly influence that.

If you just want to encrypt 32 bit values you should also have a look at Format Preserving Encryption (FPE). Those modes of operation can use standardized ciphers while achieving the same goal (although possibly at the cost of efficiency).

• "as it hasn't been analyzed" - If it is an NSA cipher I'd guess there was extensive analysis, which is not public however....
– SEJPM
May 19 '16 at 13:55
• Same difference :) May 19 '16 at 13:56
• The reference implementation of Skip32 seems to be this. The key is nominally 80-bit, and the cipher is at least fair. Options include an attack on the operating mode; and brute force, but with a lot of resources.
– fgrieu
May 19 '16 at 14:21
• @SEJPM Skipjack has a 64 bit block size. Skip32 is 32 bit. That's a significant difference alone and makes any internal analysis NSA did questionable. I think the point is however there's no design document that tells you how the two differ. May 19 '16 at 15:11
• Also, skip32 appears to have 24 rounds. SkipJack has 32. The C code says the rounds are "doubled up". I don't know what this means, but the two algorithms are fairly different from one another. May 19 '16 at 15:16

If you want to attack the block cipher, then there are no generic attacks which use the block size.

However, if you want to use a block cipher for messages which are longer than 32 bits, then you will have to use it in a mode of operation, like GCM, or OMAC (more popular modes are CBC and CTR, but they should not be used for communication on their own since they provide no authenticity). With these modes the block size plays an important role, since security degrades as you continue to process data. Typically, the degradation can be calculated using this formula: $$\frac{\sigma^2}{2^n} \le \epsilon\,,$$ where $\sigma$ is the number of blocks you've processed, $n$ is the block size (in this case $32$), and $\epsilon$ is your 'tolerance', or how likely attackers will be successful. Note that the moment you pass these bounds, then you will get attacks with success probability $\epsilon$.

Filling in some numbers, let's say that you can only tolerate attackers which succeed with probability one in a million, so $\epsilon = 1/2^{20}$. This means with a $32$ bit block size that $\sigma$ must be less than $2^6$, which is $64$ blocks, or 2 kilobytes of data. After processing 2 kilobytes you would have to switch keys.

Whether or not you should use a $32$ bit block cipher depends on how easy it is for attackers to collect data, how much data you need to process, and how difficult it is to keep switching keys.

As Maarten Bodewes mentioned above, if your messages are really short, you might be better off using format preserving encryption or small domain encryption.

If you're looking for other 32 bit block ciphers, there's KATAN32, RC5, and, although I can't recommend them because they're from the NSA, there's also Simon and Speck.

• Nothing wrong with Simon and Speck. Why the mistrust? nothing hidden there. Mar 3 '19 at 23:44
• @pxdnr Thanks for the great write-up! The formula you explained makes a lot of sense. Is there a source (a scientific paper or book on this topic) that mentions this formula? I wasn't able to find one. Jul 23 '19 at 10:16
• Hey @jonhue, you can usually find these formulas in the papers proving security of the modes of operation. See for example the following paper on GCM (pdf should be accessible): link.springer.com/chapter/10.1007/978-3-642-32009-5_3 Jul 26 '19 at 3:38