I've heard again and again that many crypto systems have been broken in the past for one reason or another and that it is best to use one that has been peer reviewed, etc etc. However, I've yet to see a source (website, book) that gives information about these systems. Is there such a thing?
$\begingroup$
$\endgroup$
4
-
4$\begingroup$ Concerning primitives, the SHA-3 candidates that didn't make round 2 are a nice list: ehash.iaik.tugraz.at/wiki/The_SHA-3_Zoo $\endgroup$– CodesInChaosFeb 4, 2013 at 20:39
-
$\begingroup$ @CodesInChaos: +1. Great link. There are some 10 SHA-3 candidates which were completely broken. $\endgroup$– David SchwartzFeb 5, 2013 at 11:30
-
1$\begingroup$ NSA had designed an algorithm on which an attack was found only hours after its declassification. See en.wikipedia.org/wiki/Skipjack_%28cipher%29 $\endgroup$– Mok-Kong ShenFeb 5, 2013 at 12:47
-
1$\begingroup$ Applied Cryptanalysis $\endgroup$– mikeazoFeb 6, 2013 at 13:43
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
2
If you want to look back in time, ENIGMA was the standard used by the nazis in the 30-40's. It would be useless to encrypt anything with it now.
More recently, pratical attacks have been done against parts of the GSM standard (what cell-phones use). The cipher A5/2 which is considered completely broken and has for this reason been remove from the standard. Actually, A5/3, supposed to be better, is not looking great either right now as an attack requiring a regular computer has been done recently (2010, see wikipedia link).
These are example of practical attacks against "real life" algorithms.
You also have algorithms which never made it outside academia because of their weakness. For instance, MacGuffin was broken at the same conference it was presented!
At last, "broken" is a rather vague concept. An algorithm is usually considered "broken" if attacks much more efficient than brute-force can be done... But that does not mean they are pratical! For instance, PUFFIN (a lightweight cipher) is considered broken due to vulneranility against differential cryptanalysis. However, the amount of data required to perform the attack remains unpractically high.
For this reason, you may consider DES to not be broken because no attack is more efficient than brute-force in its case (as far as I know). However, the problem is that a brute-force attack is possible nowadays because the key size (56 bits) is too small.
answered Feb 5, 2013 at 22:17
-
$\begingroup$ A5/3 is fine, for its intended purpose. The claims that it is broken are greatly exaggerated. $\endgroup$– D.W.Feb 6, 2013 at 19:21
-
$\begingroup$ That attack of A5/3 is a related key attack. So unless you're using a really weird protocol, it's not relevant in practice. Just like related key attacks against AES are pretty irrelevant. $\endgroup$ Feb 7, 2013 at 18:58
$\begingroup$
$\endgroup$
1
This is specific to TLS, but this paper lists the (surprisingly large) number of security flaws that have been found in TLS and TLS implementations.
-
1$\begingroup$ I'm starting to get a sense that the best approach is just to look for papers from IACR. $\endgroup$ Feb 4, 2013 at 20:34