Editing Block cipher (section)

==Cryptanalysis==
{{expand section|1=Introduction of attack models may be needed for the cryptanalysis techniques: ciphertext only, known plaintext, chosen plaintext, chosen ciphertext, etc.|date=April 2012}}

===Brute-force attacks===
{{expand section|1=Impact of key size and block size, discuss time–m to the [[birthday attack]].|date=January 2019}} This property results in the cipher's security degrading quadratically, and needs to be taken into account when selecting a block size. There is a trade-off though as large block sizes can result in the algorithm becoming inefficient to operate.<ref>{{cite book|author=Martin, Keith M.|title=Everyday Cryptography: Fundamental Principles and Applications|publisher=Oxford University Press|year=2012|isbn=9780199695591|page=114|url=https://books.google.com/books?id=5DZ_vv-gl4oC&pg=PA114}}</ref> Earlier block ciphers such as the [[Data Encryption Standard|DES]] have typically selected a 64-bit block size, while newer designs such as the [[Advanced Encryption Standard|AES]] support block sizes of 128 bits or more, with some ciphers supporting a range of different block sizes.<ref>{{cite book|last=Paar|first=Christof|title=Understanding Cryptography: A Textbook for Students and Practitioners|publisher=Springer|year=2010|isbn=9783642041006|page=30|url=https://books.google.com/books?id=f24wFELSzkoC&pg=PA30|display-authors=etal}}</ref>

===Differential cryptanalysis===
{{Main|Differential cryptanalysis}}
{{expand section|date=April 2012}}

===Linear cryptanalysis===
{{Main|Linear cryptanalysis}}

''[[Linear cryptanalysis|A linear cryptanalysis]]'' is a form of cryptanalysis based on finding [[affine transformation|affine]] approximations to the action of a [[cipher]]. Linear cryptanalysis is one of the two most widely used attacks on block ciphers; the other being [[differential cryptanalysis]].<ref>{{Cite journal|last=Matsui|first=Mitsuru|title=Linear Cryptanalysis of DES Cipher|url=http://ftp.esat.kuleuven.ac.be/pub/cosic/rijmen/misc/lin_cr.ps|journal=Mitsubishi Electric Corporation|volume=1|issue=3|pages=43|via=Computer & Information Systems Laboratory}}</ref>

The discovery is attributed to [[Mitsuru Matsui]], who first applied the technique to the [[FEAL]] cipher (Matsui and Yamagishi, 1992).<ref name="FEAL_linear">{{cite conference |author1=Matsui, M. |author2=Yamagishi, A. |name-list-style=amp | title = A new method for known plaintext attack of FEAL cipher | book-title = Advances in Cryptology – [[EUROCRYPT]] 1992 }}</ref>

===Integral cryptanalysis===
{{Main|Integral cryptanalysis}}
''[[Integral cryptanalysis]]'' is a cryptanalytic attack that is particularly applicable to block ciphers based on substitution–permutation networks. Unlike differential cryptanalysis, which uses pairs of chosen plaintexts with a fixed XOR difference, integral cryptanalysis uses sets or even multisets of chosen plaintexts of which part is held constant and another part varies through all possibilities. For example, an attack might use 256 chosen plaintexts that have all but 8 of their bits the same, but all differ in those 8 bits. Such a set necessarily has an XOR sum of 0, and the XOR sums of the corresponding sets of ciphertexts provide information about the cipher's operation. This contrast between the differences between pairs of texts and the sums of larger sets of texts inspired the name "integral cryptanalysis", borrowing the terminology of calculus.{{citation needed|date=April 2012}}

===Other techniques===
[[File:Attaque boomerang.png|thumb|right|200px|The development of the [[boomerang attack]] enabled [[differential cryptanalysis]] techniques to be applied to many ciphers that had previously been deemed secure against differential attacks]]
In addition to linear and differential cryptanalysis, there is a growing catalog of attacks: [[truncated differential cryptanalysis]], partial differential cryptanalysis, [[integral cryptanalysis]], which encompasses square and integral attacks, [[slide attack]]s, [[boomerang attack]]s, the [[XSL attack]], [[impossible differential cryptanalysis]], and algebraic attacks. For a new block cipher design to have any credibility, it must demonstrate evidence of security against known attacks.<ref>{{Citation |last=Wu |first=Shengbao |title=Security Evaluation against Differential Cryptanalysis for Block Cipher Structures |date=2011 |url=https://eprint.iacr.org/2011/551 |access-date=2025-01-01 |last2=Wang |first2=Mingsheng}}</ref>