It's considered "deeply flawed" by one (rather famous) cryptographer. And by "deeply flawed" he meant [1] that if the attacker has 2^64 plaintext/ciphertext pai

It's considered "deeply flawed" by one (rather famous) cryptographer. And by "deeply flawed" he meant [1] that if the attacker has 2^64 plaintext/ciphertext pairs, he can then attack ciphertext 256 times faster than by bruteforce. The relevance of this "deep flaw" to a realistic attack is unclear. (The attacker will need at least 0.25 zettabyte storage for those plaintext/ciphertext pairs - and don't forget about the time and bandwidth for obtaining them...) TL;DR: GOST 28147-89 is an old cipher. You shouldn't use it today because there are newer and stronger algorithms available. But for its time, it was a brilliant algorithm, and attacking it still requires NSA-level resources. And if you are interested and can read Russian, see [2] for a summary of known ways to attack GOST. [1] http://eprint.iacr.org/2011/211 http://eprint.iacr.org/2011/211 [2] https://ru.wikipedia.org/wiki/Криптоанализ_ГОСТа_28147-89 https://ru.wikipedia.org/wiki/Криптоанализ_ГОСТа_28147-89