Right. But can you explain *why* you strongly believe in it?
In the last 10 years it never failed to tell the difference between good and bad ciphers. The only thing that makes it controversial is its ability to detect flaws in ciphers believed to be strong simply because no attacks against them are found yet.
We do not believe in the approach "if no one broke it in N years, then accept it as secure until they do" alone. We believe in combining it with studying algebraic structure of the resulting functions from every angle with automated tools, and if they display obvious sparsity or patterns in the distribution of monomials of any algebraic degree, or if the size/output or size/security proportions are too low, or if too many rounds are required for a change to make those functions different in a way indistinguishable from random (slow avalanche of change as we see it), the cipher should be discarded even if no one can find a way to break it.
Here's an example: replace XOR with ADD in RC5 and try to attack it by any means other than the Mod N attack found years after RC5... But our tests immediately show that the cipher is easily breakable. They also immediately show weakness of the first two bytes in RC4 and breakability of such ciphers as A5, LILI, etc. The list can go on and on. Often there is no explanation for years until an attack is found, but our tests help us detect presence of flaws in seemingly strong ciphers in a matter of minutes. I personally do not bother analysing ciphers that fail our tests - someone else will break them sooner or later anyway. I immediately discard them as breakable and concentrate on the hard ones to see if the cipher structure needs to be addressed. But if the cipher doesn't have any odd components that it relies on and that can be attacked individually and if its proportions are chosen correctly, I accept it as secure.
The fact that Rijndael fails our tests so terribly prohibits me personally from trusting it even though no attack breaking it has been published. I would use Twofish or RC6 instead. Passing our tests combined with years of public scrutiny makes me believe that Twofish and RC6 can be trusted. Rijndael cannot.
Ruptor
--------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to [EMAIL PROTECTED]
