1
$\begingroup$

The common knowledge is that increasing the round of a block cipher can make it more secure. This is quite true if we consider the linear and differential attacks.

The Tiny encryption algorithm is also the support of this knowledge. It has a simple round, and it becomes secure after 32 rounds. Even Schneier et. al has the support this knowledge in their TwoFish Paper

However, with enough rounds, even bad round functions can be made to be secure.

Even some of last round AES candidates wanted a higher round (32 rounds) Rijndael

All of these ( and even more) support this knowledge;

$$\text{More round is more secure.}$$

  • Are there any proof of this claim? or
  • Did somebody build a pathetical block cipher that is secure $n$ round but not secure after $n$.
$\endgroup$
8
  • $\begingroup$ Surely anecdotal evidence proves this? Virtually all cipher attacks are done incrementally versus the number of rounds. You can mathematically generalise the avalanche effect of a primitive (thus prove), but I think you'll struggle to generalise a cryptographic attack against unspecified constructs. $\endgroup$
    – Paul Uszak
    Jul 7 at 12:35
  • 2
    $\begingroup$ You might be able to build a dodgy key schedule that nullifies itself when repeated. $\endgroup$
    – Paul Uszak
    Jul 7 at 12:36
  • $\begingroup$ @PaulUszak Yes, those are all some thoughts, not proof. Considering against known attacks is not proof either. Looking for some work on this.. $\endgroup$
    – kelalaka
    Jul 7 at 12:51
  • 3
    $\begingroup$ Could such a cipher be created? Yes, simply have the rounds mirror earlier rounds after a pivot point - so 16 rounds work normally, next 16 are the reverse of the first 16. So 17 rounds would be equivalent to 15 rounds, 32 rounds to 0 rounds etc. As noticed by another commenter a purposely bad key schedule would be one way to do this. $\endgroup$
    – Brian
    Jul 7 at 13:57
  • 3
    $\begingroup$ I'd dispute the "more rounds is more secure" notion entirely. It's better (absent weird self-negating cycles) for the Confidentiality and (in AEADs) Integrity parts of CIA, but it slows the system down and thus reduces Availability. So once the C and I are "good enough" any additional rounds reduce overall security, by increasing the vulnerability to denial-of-service through excessive resource use. Or they discourage people from using the cipher in the first place. TLS being "slow" was a major problem with getting it deployed for decades. $\endgroup$ Jul 7 at 14:19
4
$\begingroup$

While more rounds generally increases resistance to attacks (known ones, at least), Biham and Chen showed that 82-round SHA-0 is actually weaker than 80-round SHA-0 [PDF].

(Read "weaker" as meaning "easier to find collisions." And, while you asked about block ciphers, we often consider hash functions as housing internal block ciphers, so I thought it was still a fitting example.)

$\endgroup$
2
  • $\begingroup$ Kudos for the reference. As others have put in comment, it's easy to construct ciphers or hashes where the premise that more rounds help is false to arbitrary degree; but it's a different thing to see it happen in something that used to be promoted as a standard. $\endgroup$
    – fgrieu
    Sep 4 at 10:44
  • $\begingroup$ @fgrieu this is what I was wonder. Thanks to Justin to bring this. We learned that it is possible even for the standard and secure systems. $\endgroup$
    – kelalaka
    Sep 5 at 13:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.