Algebraic cryptanalysis of DES

Hi,

Recently, Courtois and Bard published a new paper on algebraic
cryptanalysis of DES (see http://eprint.iacr.org/2006/402 .

Citing the abstract:

"In this paper we finally show that practical algebraic attacks are in
fact possible for reduced-round versions of DES. This is the first
known example of a working algebraic attack on up to 10 rounds of a
real-life ``industrial'' block cipher. The attack requires only ONE
SINGLE KNOWN PLAINTEXT (instead of a very large quantity). This is an
unprecedented thing that has no equivalent in any cryptographic attack
ever done.

Though (on a PC) we recover the key for only six rounds, in a weaker
sense we can break 12 full rounds of DES. These results are very
interesting because DES is known to be a very robust cipher, and our
methods are very generic. Thus, if DES is susceptible to this kind of
algebraic cryptanalysis, then probably nearly any other cipher is, and
some may be substantially weaker."

Could anyone please comment on this paper? Is the attack described
really easier than a brute force attack on (10 rounds of) DES?

Thanks.

.

Relevant Pages

  • Re: "Alien" cryptanalysis
    ... >>has an attack on 31 rounds of Serpent. ... > DES has exactly as many rounds as it needed for its key size. ... > designers knew what they were doing, did what was necessary, and ...
    (sci.crypt)
  • Re: Any comments against Helix?
    ... > attack the PRNG side of it? ... This paper was presented at FSE04, however it does not describe an ... Pieprzyk - Algebraic Attacks on SOBER-t32 and SOBER-128" ...
    (sci.crypt)
  • she wants to love vertical charters next to Moammars airport
    ... Can will you occupy the determined ashamed shames before Sadam does? ... slip was moderate, pretty, and rounds in the light of the festival. ... Other surviving pregnant complications will ... attack forwards for instance doubles. ...
    (sci.crypt)
  • Re: Any truth to rumor that NSA had Public Key Crypto first?
    ... the best differential attack against full single DES requires 2^47 ... takes about 2^60 steps and uses ...2^60 chosen plaintexts". ...
    (sci.crypt)
  • Re: Some questions on DES Encryption...
    ... If all you have to go on is a single plaintext-ciphertext pair, ... DES uses a 56-bit key, ... > I think you're thinking of linear or differential cryptanalysis here. ... world discovered this attack. ...
    (SecProg)