In cryptography

Cryptography

Cryptography is the practice and study of techniques for secure communication in the presence of third parties...

, M6 is a block cipher

Block cipher

In cryptography, a block cipher is a symmetric key cipher operating on fixed-length groups of bits, called blocks, with an unvarying transformation. A block cipher encryption algorithm might take a 128-bit block of plaintext as input, and output a corresponding 128-bit block of ciphertext...

 proposed by Hitachi

Hitachi, Ltd.

is a Japanese multinational conglomerate headquartered in Marunouchi 1-chome, Chiyoda, Tokyo, Japan. The company is the parent of the Hitachi Group as part of the larger DKB Group companies...

 in 1997 for use in the IEEE 1394 FireWire standard. The design allows some freedom in choosing a few of the cipher's operations, so M6 is considered a family of ciphers.

The algorithm operates on blocks of 64 bits using a 10-round Feistel network

Feistel cipher

In cryptography, a Feistel cipher is a symmetric structure used in the construction of block ciphers, named after the German-born physicist and cryptographer Horst Feistel who did pioneering research while working for IBM ; it is also commonly known as a Feistel network. A large proportion of block...

structure. The key size

Key size

In cryptography, key size or key length is the size measured in bits of the key used in a cryptographic algorithm . An algorithm's key length is distinct from its cryptographic security, which is a logarithmic measure of the fastest known computational attack on the algorithm, also measured in bits...

 is 40 bits by default, but can be up to 64 bits. The key schedule

Key schedule

[[Image:DES-key-schedule.png|thumbnail|220px|The key schedule of DES [[Image:DES-key-schedule.png|thumbnail|220px|The key schedule of DES [[Image:DES-key-schedule.png|thumbnail|220px|The key schedule of DES ("[[Image:DES-key-schedule.png|thumbnail|220px|The key schedule of DES ("...

 is very simple, producing two 32-bit subkeys: the high 32 bits of the key

Key (cryptography)

In cryptography, a key is a piece of information that determines the functional output of a cryptographic algorithm or cipher. Without a key, the algorithm would produce no useful result. In encryption, a key specifies the particular transformation of plaintext into ciphertext, or vice versa...

, and the sum mod 2³² of this and the low 32 bits.

Because its round function is based on rotation and addition, M6 was one of the first ciphers
attacked by mod n cryptanalysis

Mod n cryptanalysis

In cryptography, mod n cryptanalysis is an attack applicable to block and stream ciphers. It is a form of partitioning cryptanalysis that exploits unevenness in how the cipher operates over equivalence classes modulo n...

. Mod 5, about 100 known plaintexts suffice to distinguish the output from a pseudorandom permutation

Pseudorandom permutation

In cryptography, the term pseudorandom permutation, abbreviated PRP, refers to a function that cannot be distinguished from a random permutation with practical effort.A pseudorandom permutation family is a collection of pseudorandom permutations,...

. Mod 257, information about the secret key itself is revealed. One known plaintext reduces the complexity of a brute force attack

Brute force attack

In cryptography, a brute-force attack, or exhaustive key search, is a strategy that can, in theory, be used against any encrypted data. Such an attack might be utilized when it is not possible to take advantage of other weaknesses in an encryption system that would make the task easier...

 to about 2³⁵ trial encryptions; "a few dozen" known plaintexts lowers this number to about 2³¹. Due to its simple key schedule, M6 is also vulnerable to a slide attack

Slide attack

The slide attack is a form of cryptanalysis designed to deal with the prevailing idea that even weak ciphers can become very strong by increasing the number of rounds, which can ward off a differential attack. The slide attack works in such a way as to make the number of rounds in a cipher irrelevant...

, which requires more known plaintext but less computation.