Complementation-Like and Cyclic Properties of AES Round Functions

Le, Tri Van; Sparr, Rüdiger; Wernsdorf, Ralph; Desmedt, Yvo

doi:10.1007/11506447_11

Cited by 22 publications

(23 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For instance, for round 9, the input (resp. output) difference of AES 0 is ΔR 7 . We can recover two more S 7 words (of additional 2 rounds) if we shift the round where we apply the difference Δα and instead to P 0 we introduce Δα at P 2 and Δβ at P 3 .…”

Section: Recovery Of State Wordsmentioning

confidence: 99%

“…We first recall the known symmetric property of the AES round function [7]. Namely, if a state is symmetric in the sense that its two halves are equal, then the keyless round function AES 0 of the AES maintains this property.…”

Section: Symmetric Properties Of the Aes Round Functionmentioning

confidence: 99%

“…Namely, if a state is symmetric in the sense that its two halves are equal, then the keyless round function AES 0 of the AES maintains this property. We recall the property of [7] using block matrices, and we introduce the following more general notations:…”

Section: Symmetric Properties Of the Aes Round Functionmentioning

confidence: 99%

See 2 more Smart Citations

Practical Cryptanalysis of PAES

Jean

Nikolić

Sasaki

et al. 2014

Selected Areas in Cryptography -- SAC 2014

View full text Add to dashboard Cite

Abstract. We present two practical attacks on the CAESAR candidate PAES. The first attack is a universal forgery for any plaintext with at least 240 bytes. It works for the nonce-repeating variant of PAES and in a nutshell it is a state recovery based on solving differential equations for the S-box leaked throught the ciphertext that arise when the plaintext has a certain difference. We show that to produce the forgery based on this method the attacker needs only 2 11 time and data. The second attack is a distinguisher for 2 64 out of 2 128 keys that requires negligible complexity and only one pair of known plaintext-ciphertext. The attack is based on the lack of constants in the initialization of the PAES which allows to exploit the symmetric properties of the keyless AES round. Both of our attacks contradict the security goals of PAES.

show abstract

Section: Recovery Of State Wordsmentioning

confidence: 99%

Section: Symmetric Properties Of the Aes Round Functionmentioning

confidence: 99%

See 1 more Smart Citation

Practical Cryptanalysis of PAES

Jean

Nikolić

Sasaki

et al. 2014

Selected Areas in Cryptography -- SAC 2014

View full text Add to dashboard Cite

show abstract

“…For example, in [19] a subset of invariant values under the encryption process (in weak key classes) in PRINTcipher are identified. Another example is the subset of special states identified in [18] which contains states whose left half is equal to the right half, and is an invariant of the encryption under keyless AES. We also note the close relationship between our approach and many of the self-similarity properties identified over the years.…”

Section: Introductionmentioning

confidence: 99%

Collision Attacks on Up to 5 Rounds of SHA-3 Using Generalized Internal Differentials

Dinur

Dunkelman

Shamir

2014

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. On October 2-nd 2012 NIST announced its selection of the Keccak scheme as the new SHA-3 hash standard. In this paper we present the first published collision finding attacks on reduced-round versions of Keccak-384 and Keccak-512, providing actual collisions for 3-round versions, and describing an attack which is 2 45 times faster than birthday attacks for 4-round Keccak-384. For Keccak-256, we increase the number of rounds which can be attacked to 5. All these results are based on a generalized internal differential attack (introduced by Peyrin at Crypto 2010), and use it to map a large number of Keccak inputs into a relatively small subset of possible outputs with a surprisingly large probability. In such a squeeze attack it is easier to find random collisions in the reduced target subset by a standard birthday argument.

show abstract

“…In this paper, we only focus on ECHO-256 and refer to the original publication [1] for more details on both ECHO-256 and ECHO-512 versions. Note that the keys used in the two AES rounds are an internal counter and the salt, respectively: they are mainly introduced to break the existing symmetries of the AES unkeyed permutation [7]. Since we are not using any property relying on symmetry and that adding constants does not change differences, we omit these steps.…”

Section: Introductionmentioning

confidence: 99%

Practical Near-Collisions and Collisions on Round-Reduced ECHO-256 Compression Function

Jean

Fouque

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. In this paper, we present new results on the second-round SHA-3 candidate ECHO. We describe a method to construct a collision in the compression function of ECHO-256 reduced to four rounds in 2 52 operations on AES-columns without significant memory requirements. Our attack uses the most recent analyses on ECHO, in particular the SuperSBox and SuperMixColumns layers to utilize efficiently the available freedom degrees. We also show why some of these results are flawed and we propose a solution to fix them. Our work improves the time and memory complexity of previous known techniques by using available freedom degrees more precisely. Finally, we validate our work by an implementation leading to near-collisions in 2 36 operations for the 4-round compression function.

show abstract

Complementation-Like and Cyclic Properties of AES Round Functions

Cited by 22 publications

References 10 publications

Practical Cryptanalysis of PAES

Practical Cryptanalysis of PAES

Collision Attacks on Up to 5 Rounds of SHA-3 Using Generalized Internal Differentials

Practical Near-Collisions and Collisions on Round-Reduced ECHO-256 Compression Function

Contact Info

Product

Resources

About