of the XOR operation, it is reversible. Cryptanalysis At a glance, Madryga seems less secure than, for example, DES. All of Madryga's operations are linear. DES's S-boxes are its only non-linear component, and flaws in them are what both differential cryptanalysis and linear cryptanalysis seek to exploit. While Madryga's rotations are data-dependent to a small degree, they are still linear. Perhaps Madryga's fatal flaw is that it does not exhibit the avalanche effect. Its small data block is to blame for this. One byte can only influence the two bytes to its left and the one byte to its right. Eli Biham has reviewed the algorithm without making a formal analysis. He noticed that "the parity of all the bits of the plaintext and the ciphertext is a constant, depending only on the key. So, if you have one plaintext and its corresponding ciphertext, you can predict the parity of the ciphertext for any plaintext." Here, parity refers to the XOR sum of all the bits. In 1995, Ken Shirriff found a differential attack on Madryga that requires 5,000 chosen plaintexts. Biryukov and Kushilevitz (1998) published an improved differential attack requiring only 16 chosen-plaintext pairs, and then demonstrated that it could be converted to a ciphertext-only attack using 212 ciphertexts, under reasonable assumptions about the redundancy of the plaintext (for example, ASCII-encoded English language). A ciphertext-only attack is devastating for a modern block cipher; as such, it is probably more prudent to use another algorithm for encrypting sensitive data. References Further reading W. E. Madryga, "A High Performance Encryption Algorithm", Computer Security: A Global Challenge, Elsevier Science Publishers, 1984, pp. 557–570. Broken block ciphers