Editing REDOC (section)

{{Short description|Family of block ciphers}}
In [[cryptography]], '''REDOC II''' and '''REDOC III''' are [[block cipher]]s designed by cryptographer [[Michael Wood (cryptographer)|Michael Wood]] for Cryptech Inc and are optimised for use in software. Both REDOC ciphers are patented.<ref>Bruce Schneier ''Applied cryptography: protocols, algorithms, and source code in C'' 1996 "REDOC III REDOC HI is a streamlined version of REDOC n, also designed by Michael Wood [1615]. It operates on an 80-bit block. The key length is variable and can be as large as 2560 bytes (20,480 bits). "</ref>

REDOC II (Cusick and Wood, 1990) operates on 80-bit blocks with a 160-bit key. The cipher has 10 rounds, and uses key-dependent [[S-box]]es and ''masks'' used to select the tables for use in different rounds of the cipher. Cusick found an attack on one round, and Biham and Shamir (1991) used [[differential cryptanalysis]] to attack one round with 2300 encryptions. Biham and Shamir also found a way of recovering three masks for up to four rounds faster than exhaustive search. A prize of US$5,000 was offered for the best attack on one round of REDOC-II, and $20,000 for the best practical [[known-plaintext attack]].

REDOC III is a more efficient cipher. It operates on an [[Block size (cryptography)|80-bit block]] and accepts a variable-length key of up to 20,480 bits. The algorithm consists only of [[XOR]]ing key bytes with message bytes, and uses no permutations or substitutions. Ken Shirriff describes a differential attack on REDOC-III requiring 2<sup>20</sup> [[chosen plaintext]]s and 2<sup>30</sup> memory.