Cryptanalysis requires years of study and practical work. One determines whether or not a cipher is secure by applying rigorous analysis based on that study and

Cryptanalysis requires years of study and practical work. One determines whether or not a cipher is secure by applying rigorous analysis based on that study and work, by attempting all known attacks, and by reviewing the design itself to ensure that it has been conceived to be secure against all known attacks - other than brute force - then reviewing the implementation. The most telling line in this article is I'm still a student. Those are information I've gathered and this is my understanding of it. Do not draw conclusions from this article, these are basically the initial notes of someone new to the field. I'd invite this person to investigate in detail the histories of SHA-3 and of AES, at least as far as the getting to the last few candidate algorithms. Those histories contain considerable information about what was wrong with previous digests and symmetric algorithms and about the state of the art in cryptanalysis prior to and during the development of these algorithms, and suggests promising areas for future research. How do tell if an cipher is secure? We work very, very hard to break it, using every trick we know, theoretical and practical. Then we invent new ones. Eventually, we develop criteria for a risk management decision: How likely is it that we did everything we could, that the cipher is as good as it appears to be? Then we wait.