2
$\begingroup$

So I heard that Twofish is much more secure than AES, because it is not vulnerable to bruteforce and only supports 256 bit.

Also I heard that is not vulnerable to most side channel attacks.

And Twofish might be much more secure because there is no known attack to it, while in AES there is a known theoretical attack.

From what I have heard twofish is not the encryption standard because it is too slow, but has a much higher security index.

So are those claims true? Is twofish really more secure? Everybody says different things. Would it be the better choice for classified top secret data?

Improve this question
$\endgroup$
0

1 Answer 1

Reset to default
9
$\begingroup$

So I heard that Twofish is much more secure than AES, because it is not vulnerable to bruteforce and only supports 256 bit .

Neither AES nor Twofish is vulnerable to brute force attack on the key in practical scenarios. Both support key sizes of 128, 192, and 256 bits, which makes them equally resistant to brute force attack.

Also I heard that is not vulnerable to most side channel attacks .

Quoting wikipedia:

Twofish's distinctive features are the use of pre-computed key-dependent S-boxes...

The use of pre-computed tables can be vulnerable to side channel attack. The table(s) contents are key-dependent, so the situation is not exactly the same as it is for AES (where the table(s) contents are known by the adversary), but it's still a cause for concern.

Additionally, side channel attacks target the practical implementation, so the theoretical algorithm is not really inherently more or less secure in regards to side channel attacks (some are just easier to secure then others). There are still concerns such as Power Analysis, Acoustic Analysis, Rubber Hose Cryptanalysis, etc.

And Twofish might be much more secure because there is no known attack to it , while in AES there is a known theoretical attack .

There are theoretical attacks on Twofish. Wikipedia has a section on the side:

Best public cryptanalysis

Truncated differential cryptanalysis requiring roughly $2^{51}$ chosen plaintexts.

Impossible differential attack that breaks 6 rounds out of 16 of the 256-bit key version using $2^{256}$ steps.

So clearly there are attacks on Twofish. They do not constitute a practical break of the cipher; Neither do any of the cryptanalytic attacks on the theoretical AES algorithm (meaning: attacks that do not use side channel analysis).

From what I have heard twofish is not the encryption standard because it is too slow , but has a much higher security index .

This appears to be accurate (as you might know already...)

So are those claims true ? Is twofish really more secure ? Everybody says different things . Would it be the better choice for classified top secret data ?

AES-256 is standardized for use to protect the confidentiality of classified top secret data. Twofish is not. It is not really a choice for people who actually have classified top-secret data to protect: AES-256 is the answer.

Improve this answer
$\endgroup$
9
  • $\begingroup$ Please be careful when copying special formatted text. The numbers $2^{51}$ and $2^{256}$ for example were not correctly copied. $\endgroup$
    – Nova
    Commented Apr 27, 2017 at 0:04
  • $\begingroup$ But are the attacks against the full-round cipher? If not, then the cipher is not "broken" in the academic sense. $\endgroup$
    – forest
    Commented Mar 22, 2018 at 2:22
  • 1
    $\begingroup$ @forest "Breaking a few rounds" is basically an unavoidable condition with symmetric ciphers - one or two rounds of any permutation will always be broken. I know of 1 attack against the full-round AES, which is the biclique attack. If I recall correctly, it is a generic attack, and is the only one that applies against the full round cipher. I'm still not sure which part of my answer is an issue. Can you please quote the contested section (if there is one?). Referring to full-round AES as "broken" seems misleading to me, as people who don't grok the details will misinterpret it. $\endgroup$
    – Ella Rose
    Commented Mar 22, 2018 at 2:45
  • 3
    $\begingroup$ @forest The following is my humble opinion: An attack being physically impossible to perform is the real goal, rather than the numbers. There is indeed a distinction between a "theoretical attack" and "broken" - the former tends to imply impossibility/impractical to perform in real life, the latter implies that it is inappropriate to use in practice. If we are to assume that a physically impossible attack that breaks the cipher qualifies the cipher as "broken", then all ciphers are broken against brute force. That seems like a slippery slope to me... $\endgroup$
    – Ella Rose
    Commented Mar 22, 2018 at 3:00
  • 1
    $\begingroup$ By my understanding, "broken" refers to any cryptographic attack against a cipher with a particular number of rounds that is faster than brute force. An attack against 12 rounds of AES256, even if it's impractical to pull off with real hardware, still means the cipher is "broken". ChaCha8 for example is "broken", despite still having a nearly 256-bit security level still, whereas ChaCha12 and ChaCha20 are not broken. ChaCha5 is also broken, but broken so badly that, despite having a 256-bit key, the security is equivalent to that of a 32-bit key. $\endgroup$
    – forest
    Commented Mar 22, 2018 at 3:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.