3.2.2 Conclusions
We have been unable to nd a way to mount this class of attack successfully against Twosh. However, we
would very much like to see more research into this kind of attack. The important requirement to remember
is that the attacker, once he has guessed the S-box key (half the total entropy), must now mount an attack
on the cipher with less work than guessing the other half of the key. Alternatively, the attacker may guess
individual S-boxes, each dened by 1=8 of the total Twosh keyspace, and try to mount an attack on the
cipher requiring less work than searching the remaining keyspace.