Analysis of MARS

This report presents the results of a limited evaluation of the block cipher MARS. No important weaknesses or flaws were found on MARS. The round function of MARS looks simple but is relatively complex to analyse because of the different natures of the involved components. MARS is an iterated cipher which runs in 32 rounds, but the rounds are not of the same type, which is somewhat unusual. The middle 16 rounds are the conjectured cryptographically strong part of MARS. The outer forward eight rounds and backward eight rounds are faster and not keyed, and were introduced to make attacks in the inner rounds more complicated. We believe that with respect to the state-of-the-art a cryptanalytic attack on 16 middle (core) rounds of MARS alone is likely to be of a very high complexity. Finally we mention that this report is the result of a limited time of review. A concentrated long analysis might reveal properties of MARS, which we were not able to detect, however it is felt with respect to the currently known attacks on block ciphers, the security margin of MARS is sufficiently high for many years.