# Cipher security summary

This article summarizes publicly known attacks against block ciphers and stream ciphers. Note that there are perhaps attacks that are not publicly known, and not all entries may be up to date.

## Best attack

This column lists the complexity of the attack:
* If the attack doesn't break the full cipher, "rounds" refers to how many rounds were broken
* "time" — time complexity, number of cipher evaluations for the attacker
* "data" — required known plaintext-ciphertext pairs (if applicable)
* "memory" — how many blocks worth of data needs to be stored (if applicable)
* "related keys" — for related-key attacks, how many related key queries are needed

## Common ciphers
### Key or plaintext recovery attacks

Attacks that lead to disclosure of the key or plaintext.
| Cipher | Security claim | Best attack | Publish date | Comment |
| AES128 | 2$^{128}$ | 2$^{126.1}$ time, 2$^{88}$ data, 2$^8$ memory | 2011-08-17 | Independent biclique attack. |
| AES192 | 2$^{192}$ | 2$^{189.7}$ time, 2$^{80}$ data, 2$^8$ memory | 2011-08-17 | Independent biclique attack. |
| AES256 | 2$^{256}$ | 2$^{254.4}$ time, 2$^{40}$ data, 2$^8$ memory | 2011-08-17 | Independent biclique attack. |
| Blowfish | Up to 2$^{448}$ | 4 of 16 rounds; 64-bit block is vulnerable to SWEET32 attack. | 2016 | Differential cryptanalysis. Author of Blowfish (Bruce Schneier) recommends using Twofish instead. SWEET32 attack demonstrated birthday attacks to recover plaintext with its 64-bit block size, vulnerable to protocols such as TLS, SSH, IPsec, and OpenVPN, without attacking the cipher itself. |
| Twofish | 2$^{128}$ – 2$^{256}$ | 6 of 16 rounds (2$^{256}$ time) | 1999-10-05 | Impossible differential attack. |
| Serpent-128 | 2$^{128}$ | 10 of 32 rounds (2$^{89}$ time, 2$^{118}$ data) | 2002-02-04 | Linear cryptanalysis. |
| Serpent-192 | 2$^{192}$ | 11 of 32 rounds (2$^{187}$ time, 2$^{118}$ data) | 2002-02-04 | Linear cryptanalysis. |
| Serpent-256 | 2$^{256}$ | 11 of 32 rounds (2$^{187}$ time, 2$^{118}$ data) | 2002-02-04 | Linear cryptanalysis. |
| DES | 2$^{56}$ | 2$^{39}$ – 2$^{43}$ time, 2$^{43}$ known plaintexts | 2001 | Linear cryptanalysis. In addition, broken by brute force in 2$^{56}$ time, no later than 1998-07-17, see EFF DES cracker. Cracking hardware is available for purchase since 2006. |
| Triple DES | 2$^{168}$ | 2$^{113}$ time, 2$^{32}$ data, 2$^{88}$ memory; 64-bit block is vulnerable to SWEET32 attack. | 2016 | Extension of the meet-in-the-middle attack. Time complexity is 2$^{113}$ steps, but along with proposed techniques, it is estimated to be equivalent to 2$^{90}$ single DES encryption steps. The paper also proposes other time–memory tradeoffs. SWEET32 attack demonstrated birthday attacks to recover plaintext with its 64-bit block size, vulnerable to protocols such as TLS, SSH, IPsec, and OpenVPN. |
| KASUMI | 2$^{128}$ | 2$^{32}$ time, 2$^{26}$ data, 2$^{30}$ memory, 4 related keys | 2010-01-10 | The cipher used in 3G cell phone networks. This attack takes less than two hours on a single PC, but isn't applicable to 3G due to known plaintext and related key requirements. |
| RC4 | Up to 2$^{2048}$ | 2$^{20}$ time, 2$^{16.4}$ related keys (95% success probability) | 2007 | Commonly known as PTW attack, it can break WEP encryption in Wi-Fi on an ordinary computer in negligible time. This is an improvement of the original Fluhrer, Mantin and Shamir attack published in 2001. |

### Distinguishing attacks

Attacks that allow distinguishing ciphertext from random data.
| Cipher | Security claim | Best attack | Publish date | Comment |
| RC4 | up to 2$^{2048}$ | ?? time, 2$^{30.6}$ bytes data (90% probability) | 2000 | Paper. |

## Less-common ciphers
### Key recovery attacks

Attacks that lead to disclosure of the key.
| Cipher | Security claim | Best attack | Publish date | Comment |
| CAST (not CAST-128) | 2$^{64}$ | 2$^{48}$ time, 2$^{17}$ chosen plaintexts | 1997-11-11 | Related-key attack. |
| CAST-128 | 2$^{128}$ | 6 of 16 rounds (2$^{88.51}$ time, 2$^{53.96}$ data) | 2009-08-23 | Known-plaintext linear cryptanalysis. |
| CAST-256 | 2$^{256}$ | 24 of 48 rounds (2$^{156.2}$ time, 2$^{124.1}$ data) | 2009-08-23 | Known-plaintext linear cryptanalysis. |
| IDEA | 2$^{128}$ | 2$^{126.1}$ time | 2012-04-15 | Narrow-biclique attack. |
| MISTY1 | 2$^{128}$ | 2$^{69.5}$ time, 2$^{64}$ chosen plaintexts | 2015-07-30 | Chosen-ciphertext, integral cryptanalysis, an improvement over a previous chosen-plaintext attack. |
| RC2 | 2$^{64}$ – 2$^{128}$ | Unknown time, 2$^{34}$ chosen plaintexts | 1997-11-11 | Related-key attack. |
| RC5 | 2$^{128}$ | Un­known | | |
| SEED | 2$^{128}$ | Un­known | | |
| Skipjack | 2$^{80}$ | 2$^{80}$ | | ECRYPT II recommendations note that, as of 2012, 80 bit ciphers provide only "Very short-term protection against agencies". NIST recommends not to use Skipjack after 2010. |
| TEA | 2$^{128}$ | 2$^{32}$ time, 2$^{23}$ chosen plaintexts | 1997-11-11 | Related-key attack. |
| XTEA | 2$^{128}$ | Un­known | | |
| XXTEA | 2$^{128}$ | 2$^{59}$ chosen plaintexts | 2010-05-04 | Chosen-plaintext, differential cryptanalysis. |

### Distinguishing attacks

Attacks that allow distinguishing ciphertext from random data.
| Cipher | Security claim | Best attack | Publish date | Comment |
| CAST-256 | 2$^{256}$ | 28 of 48 rounds (2$^{246.9}$ time, 2$^{68}$ memory, 2$^{98.8}$ data) | 2012-12-04 | Multidimensional zero-correlation cryptanalysis. |