Distinguisher and Related-Key Attack on the Full AES-256

Abstract

Abstract. In this paper we construct a chosen-key distinguisher and a related-key attack on the full 256-bit key AES. We define a notion of differential q-multicollision and show that for AES-256 q-multicollisions can be constructed in time q · 2 67 and with negligible memory, while we prove that the same task for an ideal cipher of the same block size would require at128 ) time. Using similar approach and with the same complexity we can also construct q-pseudo collisions for AES-256 in Davies-Meyer hashing mode, a scheme which is provably secure in the ideal-cipher model. We have also computed partial q-multicollisions in time q · 2 37 on a PC to verify our results. These results show that AES-256 can not model an ideal cipher in theoretical constructions. Finally we extend our results to find the first publicly known attack on the full 14-round AES-256: a related-key distinguisher which works for one out of every 2 35 keys with 2 120 data and time complexity and negligible memory. This distinguisher is translated into a key-recovery attack with total complexity of 2 131 time and 2 65 memory.

Super-Sbox Cryptanalysis: Improved Attacks for AES-Like Permutations

“…An evasive property means in this context a property impossible to achieve with the same complexity and a non-negligible probability using oracle accesses to a random function. 4 We propose to view the permutations and compression functions based upon the generic AES construction as families of permutations (resp. functions) indexed by the parameter set I = C × SB equipped with the uniform probability distribution.…”

“…a family of independent random permutations indexed by the key space, even when the key values can be chosen by an adversary. It has been recently shown that the full AES-256 does not behave as an ideal cipher due to the existence of a so-called chosen key distinguisher [4].…”

The Related-Key Analysis of Feistel Constructions

“…Since the original work of Knudsen and Biham, there have been many reported cases of successful related-key cryptanalysis [9,27,7], and notably of the Advanced Encryption Standard (AES) [10,11]. These results led to the consensual view that RKA resilience should be a standard design goal for lowlevel cryptographic primitives such as block ciphers and hash functions.…”

“…This vulnerability is relevant for practical applications of Feistel constructions, since many important cryptanalytic results such as those presented by Biryukov et al [10,11] can be described as utilizing related keys that are derived by xor-ing the original key with a constant. This in particular permits an attacker to selectively modify the secret key for the output round in a Feistel network and break the security of the construction.…”

How to Construct an Ideal Cipher from a Small Set of Public Permutations

“…A classical example is the complementation property of DES which, despite being often viewed as a "benign" undesirable property, implies that DES does not behave as an ideal cipher. For AES, no such non-random properties were known until Biryukov et al [10] showed that socalled q-multicollisions can be found faster for AES-256 than for an ideal cipher. Known-key and chosen-key attacks were first put forward as an important cryptanalysis goal by Knudsen ans Rijmen [36], and have since then become an active area of research [48,27,54].…”