Hi,
Recently, Courtois and Bard published a new paper on algebraic
cryptanalysis of DES (see
http://eprint.iacr.org/2006/402 .
Citing the abstract:
"In this paper we finally show that practical algebraic attacks are in
fact possible for reduced-round versions of DES. This is the first
known example of a working algebraic attack on up to 10 rounds of a
real-life ``industrial'' block cipher. The attack requires only ONE
SINGLE KNOWN PLAINTEXT (instead of a very large quantity). This is an
unprecedented thing that has no equivalent in any cryptographic attack
ever done.
Though (on a PC) we recover the key for only six rounds, in a weaker
sense we can break 12 full rounds of DES. These results are very
interesting because DES is known to be a very robust cipher, and our
methods are very generic. Thus, if DES is susceptible to this kind of
algebraic cryptanalysis, then probably nearly any other cipher is, and
some may be substantially weaker."
Could anyone please comment on this paper? Is the attack described
really easier than a brute force attack on (10 rounds of) DES?