Editing MacGuffin (cipher) (section)

==Cryptanalysis of MacGuffin==
At the same workshop where MacGuffin was introduced, Rijmen and Preneel showed that it was vulnerable to [[differential cryptanalysis]]. They showed that 32 rounds of MacGuffin is weaker than 16 rounds of DES, since it took "a few hours" to get good differential characteristics for DES with good starting values, and the same time to get good differential characteristics for MacGuffin with no starting values. They found that it is possible to get the last round key with differential cryptanalysis, and from that reverse the last round; and then repeat the attack for the rest of the rounds.

Rijmen and Preneel tried attacking MacGuffin with different S-boxes, taken directly from DES. This version proved to be slightly stronger, but they warn that designing an algorithm to resist only known attacks is generally not a good design principle.