In this Wikipedia article about Neural cryptography (section applications) it states:

In 1995, Sebastien Dourlens applied neural networks to cryptanalyze DES by allowing the networks to learn how to invert the S-tables of the DES. The bias in DES studied through Differential Cryptanalysis by Adi Shamir is highlighted. The experiment shows about 50% of the key bits can be found, allowing the complete key to be found in a short time.

It could very well be that I misunderstood something, but I think that the same "attack" can't be used for AES, since the Inverse Rijndael S-box is public knowledge or am I wrong? Is AES designed this way to prevent an attack by inverting the S-box?


No. Neuro-Cryptanalysis fails on serious ciphers, including DES and AES.

Sebastien Dourlens's Neuro-differential cryptanalysis of DES (in sections 5.4.2 and 5.4.3 of his 1996 mémoire) learns an S-box. Applied to Unix crypt (section 5.4.4), it memorizes passwords/hash pairs (by a training requiring "from several days to several years") and then merely performs a quick retrieval; something a hash table does routinely and quickly! Neither is relevant to cryptanalysis.

Mohammed M. Alani's Neuro-Cryptanalysis of DES and Triple-DES (in proceedings of ICONIP 2012) claims cryptanalysis of DES or 3DES from 2048 or 4096 examples in an hour of Matlab on a standard PC; but there is no indication that it recovers the key or is otherwise capable of predicting more input/output mappings than supplied in training (even though the later is a stated objective). My guess is that - at best - it performs similar plaintext/ciphertext memorization thru training.

  • $\begingroup$ I think its important to note, that Neuro-Cryptanalysis has failed so far on serious ciphers. $\endgroup$ – Dylan Feb 19 at 16:35
  • $\begingroup$ @Dylan: Neuro-Cryptanalysis as in these papers (thus as in the question) examines the cipher as a black box, without a description of its internals. That's dooms such Neuro-Cryptanalysis, putting it at a tremendous disadvantage compared to traditional cryptanalysis, and automated cryptanalysis crunching a description of the cipher (e.g. encoded as a satisfiability problem). $\endgroup$ – fgrieu Feb 19 at 18:00

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.