Journal of Cryptology

, Volume 13, Issue 4, pp 417–436 | Cite as

A Detailed Analysis of SAFER K

  • Lars R. Knudsen


In this paper we analyze the block cipher SAFER K. First, we show a weakness in the key schedule, that has the effect that for almost every key there exists on the average three and a half other keys such that the encryptions of plaintexts different in one of eight bytes yield ciphertexts also different in only one byte. Moreover, the differences in the keys, plaintexts, and ciphertexts are in the same byte. This enables us to do a related-key chosen plaintext attack on SAFER K, which finds the secret key. Also, the security of SAFER K, when used in standard hashing modes, is greatly reduced, which is illustrated. Second, we propose a new key schedule for SAFER K avoiding these problems. Third, we do differential cryptanalysis of SAFER K. We consider truncated differentials and apply them in an attack on five-round SAFER K, which finds the secret key much faster than by an exhaustive search.

Key words. Cryptanalysis, Block cipher, SAFER, Truncated differentials, Collisions. 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© International Association for Criptologic Rese 2000

Authors and Affiliations

  • Lars R. Knudsen
    • 1
  1. 1.Department of Informatics, University of Bergen, Bergen, NorwayNO

Personalised recommendations