# how secure is Twofish really?

So I heard that Twofish is much more secure than AES, because it is not vulnerable to bruteforce and only supports 256 bit .

Also I heard that is not vulnerable to most side channel attacks .

And Twofish might be much more secure because there is no known attack to it , while in AES there is a known theoretical attack .

From what I have heard twofish is not the encryption standard because it is too slow , but has a much higher security index .

So are those claims true ? Is twofish really more secure ? Everybody says different things . Would it be the better choice for classified top secret data ?

So I heard that Twofish is much more secure than AES, because it is not vulnerable to bruteforce and only supports 256 bit .

Neither AES nor Twofish is vulnerable to brute force attack on the key in practical scenarios. Both support key sizes of 128, 192, and 256 bits, which makes them equally resistant to brute force attack.

Also I heard that is not vulnerable to most side channel attacks .

Quoting wikipedia:

Twofish's distinctive features are the use of pre-computed key-dependent S-boxes...

The use of pre-computed tables can be vulnerable to side channel attack. The table(s) contents are key-dependent, so the situation is not exactly the same as it is for AES (where the table(s) contents are known by the adversary), but it's still a cause for concern.

Additionally, side channel attacks target the practical implementation, so the theoretical algorithm is not really inherently more or less secure in regards to side channel attacks (some are just easier to secure then others). There are still concerns such as Power Analysis, Acoustic Analysis, Rubber Hose Cryptanalysis, etc.

And Twofish might be much more secure because there is no known attack to it , while in AES there is a known theoretical attack .

There are theoretical attacks on Twofish. Wikipedia has a section on the side:

Best public cryptanalysis

Truncated differential cryptanalysis requiring roughly $2^{51}$ chosen plaintexts.

Impossible differential attack that breaks 6 rounds out of 16 of the 256-bit key version using $2^{256}$ steps.

So clearly there are attacks on Twofish. They do not constitute a practical break of the cipher; Neither do any of the cryptanalytic attacks on the theoretical AES algorithm (meaning: attacks that do not use side channel analysis).

From what I have heard twofish is not the encryption standard because it is too slow , but has a much higher security index .

This appears to be accurate (as you might know already...)

So are those claims true ? Is twofish really more secure ? Everybody says different things . Would it be the better choice for classified top secret data ?

AES-256 is standardized for use to protect the confidentiality of classified top secret data. Twofish is not. It is not really a choice for people who actually have classified top-secret data to protect: AES-256 is the answer.

• Please be careful when copying special formatted text. The numbers $2^{51}$ and $2^{256}$ for example were not correctly copied. – Nova Apr 27 '17 at 0:04
• But are the attacks against the full-round cipher? If not, then the cipher is not "broken" in the academic sense. – forest Mar 22 '18 at 2:22
• @forest Impossible differential attack that breaks 6 rounds out of 16..., so no, they are not against the full-round cipher. I specifically mention ...They do not constitute a practical break of the cipher, so I'm not sure I understand the nature of the second part of your comment. – Ella Rose Mar 22 '18 at 2:31
• @EllaRose I meant that a break in the cipher involves any attack faster than brute force on the full-round cipher (even if it's not a practical break). Breaking a few rounds shows some weaknesses, but the full-round cipher is still not broken. AES for example has attacks against the full-round cipher and is thus considered broken, though of course not so broken that it is not secure in practice. – forest Mar 22 '18 at 2:32
• @forest "Breaking a few rounds" is basically an unavoidable condition with symmetric ciphers - one or two rounds of any permutation will always be broken. I know of 1 attack against the full-round AES, which is the biclique attack. If I recall correctly, it is a generic attack, and is the only one that applies against the full round cipher. I'm still not sure which part of my answer is an issue. Can you please quote the contested section (if there is one?). Referring to full-round AES as "broken" seems misleading to me, as people who don't grok the details will misinterpret it. – Ella Rose Mar 22 '18 at 2:45