Construction of rotation symmetric bent functions with maximum algebraic degree

Unbalanced biclique cryptanalysis of a full round Midori

“…4b, for every biclique, we encrypt S 0 with the keys K [i, 0] to obtain C i . All the ciphertexts are same in seven cells (C i [0], C i [1], C i [2], C i [3], C i [4], C i [10] and C i [13]). Thus, the data complexity does not exceed 2 36 .…”

“…In this section, we present key recovery attack with an unbalanced 8 × 12-dimensional biclique on full round Midori128, where the biclique structure is 4 rounds, MITM is 16 rounds with the total is 20. We choose cells K [1], K [2] and K [4] as active keys.…”

“…Each group key comprises a 2 8 × 2 16 matrix:{K [i, j] }. Similar to Section 3.2, we construct an 8 × 16 biclique structure by K [4] and K [1,2]. The K is grouped as shown below:…”

“…7 (left part), K [1] influences the vertical stripes cells that should be calculated 2 8 times, and K [2] causes the diagonal crosshatch cells that should be calculated 2 8 times. The grey cells are influenced by K [1] and K [2]; thus, these cells should be computed 2 16 times. The point fill cells are computed once and the white cells must not be computed.…”

“…The common analysis methods include differential analysis, impossible differential analysis, related-key, meet-in-the-middle (MITM), biclique attack, division cryptanalysis [1] and algebraic attack [2] where the MITM attack is a typical method in the cryptanalysis of block ciphers. It has been improved by many techniques [3], including splice-and-cut, initial structure and partial matching.…”