A Critique of BEAR and LION

The paper \Two Practical and Provably Secure Block Ciphers: BEAR and LION" AnBi96] by Ross Anderson and Eli Biham is summarized. The paper presents two new block ciphers (BEAR and LION) which can be built using a hash function and a stream cipher. Both these ciphers are provably secure in that a successful attack on them can be used as an attack on the underlying hash function and stream cipher. These ciphers are also potentially much faster than existing block ciphers since fast implementations of stream ciphers and hash functions already exist. The original contribution of this paper is to point out deeciencies in BEAR and LION which allow an adversary with knowledge of only half the key bits to recover part of the plaintext. It is also shown how a meet-in-the-middle attack can be used as a key recovery attack on both BEAR and LION given only one plaintext/ciphertext pair.