In cryptography, REDOC II and REDOC III are block ciphers designed by Michael Wood (cryptographer) for Cryptech Inc and are optimised for use in software. Both REDOC ciphers are patented.^[1]

REDOC II (Cusick and Wood, 1990) operates on 80-bit blocks with a 160-bit key. The cipher has 10 rounds, and uses key-dependent S-boxes and masks used to select the tables for use in different rounds of the cipher. Cusick found an attack on one round, and Biham and Shamir (1991) used differential cryptanalysis to attack one round with 2300 encryptions. Biham and Shamir also found a way of recovering three masks for up to four rounds faster than exhaustive search. A prize of US$5,000 was offered for the best attack on one round of REDOC-II, and $20,000 for the best practical known-plaintext attack.

REDOC III is a more efficient cipher. It operates on an 80-bit block and accepts a variable-length key of up to 20,480 bits. The algorithm consists only of XORing key bytes with message bytes, and uses no permutations or substitutions. Ken Shirriff describes a differential attack on REDOC-III requiring 2²⁰ chosen plaintexts and 2³⁰ memory.