The title pretty much says it all. I am looking for a formal definition of what a good crypto algorithm is. I cannot find anything online.
closed as off-topic by Jens Erat, Steffen Ullrich, Neil Smithline, Tobi Nary, John Deters Apr 10 '16 at 2:48
- This question does not appear to be about Information security within the scope defined in the help center.
A good algorithm
- satisfies security requirements (e.g. a hash function needs to be collision resistant, preimage-resistant or a cipher needs to satisfy ciphertext indistinguishability)
- the tricky part here is how to justify that it satisfies the security requirements. We rely on security reductions (''proofs''), extent of external analysis (e.g. algorithm published in a respected journal and analyzed for a couple of years could be expected ''better''' than something kept secret) and experience of the designers (e.g. I would trust the designers of AES more than some random person posting to a newsgroup)
- satisfies performance requirements for the given application and range of target platforms
- is easy to implement in a secure way (e.g. some algorithms are easier to protect against side-channels than others, simpler algorithms are easier to implement correctly)
- an extra feature is that it ''fails gracefully'' e.g. if some of the assumptions required for correct operation are not satisfied it doesn't lead to catastrophic insecurity but only degradation of the security level. A good example would be nonce reuse in authenticated encryption schemes. Some of the designs fail dramatically while others can maintain some level of security.