Cryptanalysis

1. What counts as a break

A cipher is "broken" whenever an attack beats brute force — even if it remains far out of practical reach. An attack recovering an AES-128 key in 2¹²⁶ operations instead of 2¹²⁸ is a genuine theoretical break and completely useless in practice.

This matters because headlines rarely distinguish the two. Academic breaks are early warnings, not emergencies. They tend to improve slowly, which is why cryptographers retire algorithms long before attacks become practical.

Kerckhoffs's principle governs the whole field: assume the attacker knows the algorithm. Only the key is secret. Any scheme depending on its own obscurity is already broken.

2. Frequency analysis

The first real cryptanalytic technique, described by al-Kindi in ninth-century Baghdad, ended substitution ciphers permanently.

A substitution cipher replaces each letter consistently. It hides the identity of letters but preserves their statistics. In English, E appears about 12% of the time, T about 9%. Whatever symbol dominates the ciphertext is almost certainly E.

The lesson generalises: structure in the plaintext that survives into the ciphertext is a weakness. It is the same flaw that makes ECB mode unusable today.

3. Differential and linear cryptanalysis

Modern block ciphers destroy simple statistics, so attacks became subtler.

Differential cryptanalysis studies how a controlled difference between two plaintexts propagates. In an ideal cipher the resulting output difference is uniform; any bias is information. IBM knew of this while designing DES in the 1970s and quietly hardened it — which became public only when the technique was rediscovered in 1990.

Linear cryptanalysis looks for approximate linear relations between plaintext, ciphertext and key bits that hold slightly more often than half the time. Gather enough pairs and the bias becomes usable.

AES was designed with provable resistance to both, which is why its round structure looks the way it does.

4. Birthday attacks

In a room of 23 people there is a better-than-even chance two share a birthday. The count of pairs grows quadratically, so collisions arrive far sooner than intuition suggests.

For hash functions this is decisive: an n-bit hash needs only about 2^(n/2) attempts to find a collision, not 2ⁿ.

This is why collision resistance demands double the output length you might expect, and why MD5 and SHA-1 are no longer acceptable for signatures.

5. Side channels — where breaks really happen

Modern ciphers are rarely broken mathematically. They are broken by watching the machine.

Timing attacks measure how long operations take. If a comparison exits early on the first wrong byte, response time leaks how much of a guess was correct — enough to recover secrets byte by byte. The defence is constant-time code.

Power analysis reads a device's power draw, which varies with the bits being processed. Acoustic and electromagnetic attacks have extracted keys from laptop noise and stray radiation.

All of this sits outside the mathematical model. The algorithm is perfect; the implementation talks. It is why cryptographic code is so conservative, and why writing your own is discouraged even when the maths is right.

Frequently asked questions

What is cryptanalysis?

The study of breaking cryptographic systems. An attack counts as a break whenever it beats brute force, even if it remains impractical.

What is frequency analysis?

Using the natural letter frequencies of a language to break substitution ciphers, since consistent substitution hides letter identity but preserves letter statistics.

How are modern ciphers usually broken?

Through implementation flaws rather than mathematics — timing differences, power consumption, key reuse and protocol mistakes are far more common than breaks of the algorithm itself.

What is a birthday attack?

An attack exploiting the fact that collisions in an n-bit hash appear after roughly 2^(n/2) attempts, not 2^n, because the number of possible pairs grows quadratically.

Keep going