We present the impossible differential cryptanalysis of the block cipher XTEA[7] and TEA[6]. The core of the design principle of these block ciphers is an easy implementation and a simplicity. But this simplicity dose not offer a large diffusion property. Our impossible differential cryptanalysis of reduced-round versions of XTEA and TEA is based on this fact. We will show how to construct a 12-round impossible characteristic of XTEA. We can then derive 128-bit user key of the 14round XTEA with 2 62.5 chosen plaintexts and 2 85 encryption times using the 12-round impossible characteristic. In addition, we will show how to construct a 10-round impossible characteristic of TEA. Then we can derive 128-bit user key of the 11-round TEA with 2 52.5 chosen plaintexts and 2 84 encryption times using the 10-round impossible characteristic.

Abstract. This paper describes saturation attacks on reduced-round versions of Skipjack. To begin with, we will show how to construct a 16-round distinguisher which distinguishes 16 rounds of Skipjack from a random permutation. The distinguisher is used to attack on 18(5∼22) and 23(5∼27) rounds of Skipjack. We can also construct a 20-round distinguisher based on the 16-round distinguisher. This distinguisher is used to attack on 22(1∼22) and 27(1∼27) rounds of Skipjack. The 80-bit user key of 27 rounds of Skipjack can be recovered with 2 50 chosen plaintexts and 3 · 2 75 encryption times.