Editing MARS (cipher) (section)

==Security analysis==
Subkeys with long runs of ones or zeroes may lead to efficient attacks on MARS.<ref name="Preneel-Comments-by-NESSIE-Project-on-AES-Finalists">{{citation
| author = B. Preneel
| title = Comments by the NESSIE Project on the AES Finalists
| url = http://csrc.nist.gov/archive/aes/round2/comments/20000524-bpreneel.pdf
| publisher = NIST
| year = 2000
|display-authors=etal}}</ref> The two least significant bits of round keys used in multiplication are
always set to the value 1. Thus, there are always two inputs that are unchanged through the multiplication process regardless of the subkey, and two others which have fixed output regardless of the subkey.<ref name="Preneel-Comments-by-NESSIE-Project-on-AES-Finalists"/>

A [[meet-in-the-middle attack]] published in 2004 by [[John Kelsey (cryptanalyst)|John Kelsey]] and [[Bruce Schneier]] can break 21 out of 32 rounds of MARS.<ref>[https://www.schneier.com/wp-content/uploads/2016/02/paper-mars-attacks.pdf ''MARS Attacks! Preliminary Cryptanalysis of Reduced-Round MARS Variants''] John Kelsey, Bruce Schneier, 2004</ref>