Security analysis of Spritz? Recently, a new cipher called Spritz has been released by Ronald L. Rivest and Jacob Schuldt. It should be a "drop-in replacement" for RC4. 

There are many differences to RC4, Spritz is "spongy" and also has a complete different way to handle the key setup. But still there are many similarities to RC4 in generating the key stream or the whole structure of the cipher it self. 

There are many results against RC4, so Spritz should be an interesting topic for analysis.

I have looked at some attacks on RC4 and be curious if some of them can be applied to Spritz as well. Does anybody else has analysed Spritz so far? Or is it far too early for results against Spritz?

From the performance viewpoint Spritz is really slow (compared to other related ciphers e.g. Keccak or Salsa20, SHA-256). Why didn't they go for performance? Nobody will use it if its that slow.
I have looked at some attacks on RC4 and be curious if some of them can be applied to Spritz as well. Does anybody else has analysed Spritz so far? Or is it far too early for results against Spritz?


No third party analysis. Probably way too early. (Even the paper you linked is unpublished.) The answer may of course change any time.


  From the performance viewpoint Spritz is really slow (compared to other related ciphers e.g. Keccak or Salsa20, SHA-256). Why didn't they go for performance? Nobody will use it if its that slow.


They say in the paper that they were using "a simple and unoptimized implementation of Spritz". With the possible exception of Keccak, the implementations of those other algorithms may have seen years of optimization work.

Looking at the actual numbers, Spritz generates keystream at ~95 MB/s compared to 150+ for AES and 290+ for Salsa20 and RC4. So it's slower, but not by orders of magnitude. That sort of gap could realistically be closed with optimization work, if the implementation truly is poor. It also isn't necessarily that big a deal in many applications. Further, hardware performance might look completely different, although I don't see anything to suggest that it must.

The same question could be posed of AES: why are we using AES CTR if stream ciphers like Salsa20 have twice the performance? AES of course has the advantage of being an older design that has seen its share of cryptanalysis, but versatility may also play a role. As a block cipher, AES can be used for a variety of things, from MACs to disk encryption, whereas a stream cipher is basically only for encryption and requires a MAC to prevent malleability.

Similarly, due to being a sponge function, Spritz, like Keccak, could be seen as a more versatile primitive, offering not only encryption, but also a hash function and a MAC. This would allow you to rely on fewer moving parts, hopefully avoiding bugs and security weaknesses, possibly gaining back some performance too. Having a simple algorithm also helps.

However, the hash function performance of Spritz is more than an order of magnitude slower, so I'm not sure you'd really want to choose it over Keccak...